Cherry-pick #18091 to 7.x: Use default output by default (#18119)

* [Elastic-Agent] Use default output by default (#18091)

[Elastic-Agent] Use default output by default (#18091)

x-pack/elastic-agent/CHANGELOG.asciidoc

@@ -25,6 +25,7 @@
 - Fixed injected log path to monitoring beat {pull}17833[17833]
 - Make sure that the Elastic Agent connect over TLS in cloud. {pull}17843[17843]
 - Moved stream.* fields to top of event {pull}17858[17858]
+- Use default output by default {pull}18091[18091]
 
 ==== New features
 

x-pack/elastic-agent/pkg/agent/application/monitoring_decorator.go

@@ -19,10 +19,11 @@ const (
 	monitoringOutputFormatKey = "outputs.%s"
 	outputKey                 = "output"
 
-	enabledKey       = "settings.monitoring.enabled"
-	outputsKey       = "outputs"
-	elasticsearchKey = "elasticsearch"
-	typeKey          = "type"
+	enabledKey        = "settings.monitoring.enabled"
+	outputsKey        = "outputs"
+	elasticsearchKey  = "elasticsearch"
+	typeKey           = "type"
+	defaultOutputName = "default"
 )
 
 func injectMonitoring(outputGroup string, rootAst *transpiler.AST, programsToRun []program.Program) ([]program.Program, error) {
@@ -40,17 +41,17 @@ func injectMonitoring(outputGroup string, rootAst *transpiler.AST, programsToRun
 		config[enabledKey] = false
 	} else {
 		// get monitoring output name to be used
+		monitoringOutputName := defaultOutputName
 		useOutputNode, found := transpiler.Lookup(rootAst, monitoringUseOutputKey)
-		if !found {
-			return programsToRun, nil
-		}
+		if found {
 
-		monitoringOutputNameKey, ok := useOutputNode.Value().(*transpiler.StrVal)
-		if !ok {
-			return programsToRun, nil
-		}
+			monitoringOutputNameKey, ok := useOutputNode.Value().(*transpiler.StrVal)
+			if !ok {
+				return programsToRun, nil
+			}
 
-		monitoringOutputName := monitoringOutputNameKey.String()
+			monitoringOutputName = monitoringOutputNameKey.String()
+		}
 
 		ast := rootAst.Clone()
 		if err := getMonitoringRule(monitoringOutputName).Apply(ast); err != nil {