-
Notifications
You must be signed in to change notification settings - Fork 166
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fleet-managed agents: Add logging content #897
Merged
Merged
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
85 changes: 85 additions & 0 deletions
85
docs/en/ingest-management/elastic-agent/elastic-agent-logging.asciidoc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,85 @@ | ||
[[elastic-agent-logging]] | ||
[role="xpack"] | ||
= Configure logging for Fleet-managed {agent}s | ||
|
||
Agent monitoring, which includes collecting agent logs and agent metrics, | ||
is enabled by default on each agent policy assigned to an agent. If | ||
logging for the agent is not required, you need to uncheck the logging option when | ||
creating the agent policy. | ||
|
||
. In {kib}, go to *Management > {fleet}*. | ||
|
||
. Under the *Agent policies* tab, click *Create agent policy* > *Advanced options*. | ||
|
||
. Under *Agent monitoring*, uncheck *Collect agent logs*. | ||
|
||
. To confirm your change, click *Save changes*. | ||
|
||
To disable logging on an agent policy already assigned to an agent: | ||
|
||
. Select the *Agents* tab, and then click the agent policy. | ||
|
||
. Click the *Settings* tab. | ||
|
||
. Under *Agent monitoring*, uncheck *Collect agent logs*. | ||
|
||
. To confirm your change, click *Save changes*. | ||
|
||
[discrete] | ||
[[agent-view-log-events]] | ||
== View log events | ||
|
||
The *Logs* page for each agent enables you to monitor all of the log events flowing in | ||
from your agents and integrations in a centralized view. | ||
|
||
To help you get started with your analysis faster, you can use the search bar to create | ||
structured queries using {kibana-ref}/kuery-query.html[Kibana Query Language]. Along with | ||
the power of search, you also have the option to view historical logs from a | ||
specified time range. | ||
|
||
. In {kib}, go to *Management > {fleet}*. | ||
|
||
. Under *Agents*, click the agent name listed in the *Host* column. | ||
|
||
. Click the *Logs* tab. | ||
|
||
To view log events for an agent or related programs, such as {filebeat} or {fleet-server}, | ||
make your selections under *Dataset*. | ||
|
||
[role="screenshot"] | ||
image::images/kibana-fleet-datasets.png[{fleet} showing datasets for logging] | ||
|
||
To view specific log levels relating to a log event, make your selections under *Log level*. | ||
You can select from `error`, `warn`, and `info`. | ||
|
||
[role="screenshot"] | ||
image::images/kibana-fleet-log-levels.png[Selector for logging levels] | ||
|
||
When you have searched and filtered your logs for a specific log event, you may want to | ||
examine the metadata and the structured fields associated with that event in the {logs-app}. | ||
Click *Open in Logs*. | ||
|
||
[discrete] | ||
[[agent-logging-levels]] | ||
== Set the agent logging level | ||
|
||
Within {fleet}, you can specify the logging level for each agent to help | ||
troubleshoot any issues. | ||
|
||
. In {kib}, go to *Management > {fleet}*. | ||
|
||
. Under *Agents*, select the agent from the *Host* column. | ||
|
||
. Click the *Logs* tab. | ||
|
||
. Located at the bottom of the Logs page, you can select the *Agent logging level*: | ||
|
||
* `error`: Logs errors and critical errors. | ||
* `warning`: Logs warnings, errors, and critical errors. | ||
* `info`: Logs informational messages, including the number of events that are published. | ||
Also logs any warnings, errors, or critical errors. | ||
* `debug`: Logs debug messages, including a detailed printout of all events flushed. Also | ||
logs informational messages, warnings, errors, and critical errors. | ||
+ | ||
. Once you have made your selection, click *Apply changes*. | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You should use "deselect" instead of "uncheck" throughout. (Our guidelines say: "Use "select" and "deselect" for single checkboxes and "clear" for deselecting several checkboxes at the same time.")
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good to know. Thanks!