diff --git a/docs/en/ingest-management/elastic-agent/elastic-agent-logging.asciidoc b/docs/en/ingest-management/elastic-agent/elastic-agent-logging.asciidoc new file mode 100644 index 0000000000..0cc68840a2 --- /dev/null +++ b/docs/en/ingest-management/elastic-agent/elastic-agent-logging.asciidoc @@ -0,0 +1,85 @@ +[[elastic-agent-logging]] +[role="xpack"] += Configure logging for Fleet-managed {agent}s + +Agent monitoring, which includes collecting agent logs and agent metrics, +is enabled by default on each agent policy assigned to an agent. If +logging for the agent is not required, you need to deselect the logging option when +creating the agent policy. + +. In {kib}, go to *Management > {fleet}*. + +. Under the *Agent policies* tab, click *Create agent policy* > *Advanced options*. + +. Under *Agent monitoring*, deselect *Collect agent logs*. + +. To confirm your change, click *Save changes*. + +To disable logging on an agent policy already assigned to an agent: + +. Select the *Agents* tab, and then click the agent policy. + +. Click the *Settings* tab. + +. Under *Agent monitoring*, deselect *Collect agent logs*. + +. To confirm your change, click *Save changes*. + +[discrete] +[[agent-view-log-events]] +== View log events + +The *Logs* page for each agent enables you to monitor all of the log events flowing in +from your agents and integrations in a centralized view. + +To help you get started with your analysis faster, you can use the search bar to create +structured queries using {kibana-ref}/kuery-query.html[Kibana Query Language]. Along with +the power of search, you also have the option to view historical logs from a +specified time range. + +. In {kib}, go to *Management > {fleet}*. + +. Under *Agents*, click the agent name listed in the *Host* column. + +. Click the *Logs* tab. + +To view log events for an agent or related programs, such as {filebeat} or {fleet-server}, +make your selections under *Dataset*. + +[role="screenshot"] +image::images/kibana-fleet-datasets.png[{fleet} showing datasets for logging] + +To view specific log levels relating to a log event, make your selections under *Log level*. +You can select from `error`, `warn`, and `info`. + +[role="screenshot"] +image::images/kibana-fleet-log-levels.png[Selector for logging levels] + +When you have searched and filtered your logs for a specific log event, you may want to +examine the metadata and the structured fields associated with that event in the {logs-app}. +Click *Open in Logs*. + +[discrete] +[[agent-logging-levels]] +== Set the agent logging level + +Within {fleet}, you can specify the logging level for each agent to help +troubleshoot any issues. + +. In {kib}, go to *Management > {fleet}*. + +. Under *Agents*, select the agent from the *Host* column. + +. Click the *Logs* tab. + +. Located at the bottom of the Logs page, you can select the *Agent logging level*: + +* `error`: Logs errors and critical errors. +* `warning`: Logs warnings, errors, and critical errors. +* `info`: Logs informational messages, including the number of events that are published. +Also logs any warnings, errors, or critical errors. +* `debug`: Logs debug messages, including a detailed printout of all events flushed. Also +logs informational messages, warnings, errors, and critical errors. ++ +. Once you have made your selection, click *Apply changes*. + diff --git a/docs/en/ingest-management/elastic-agent/elastic-agent.asciidoc b/docs/en/ingest-management/elastic-agent/elastic-agent.asciidoc index 78620fa58a..14853144ac 100644 --- a/docs/en/ingest-management/elastic-agent/elastic-agent.asciidoc +++ b/docs/en/ingest-management/elastic-agent/elastic-agent.asciidoc @@ -25,6 +25,7 @@ To learn how to install, configure, and run your {agent}s, see: * <> * <> * <> +* <> * <> include::install-elastic-agent.asciidoc[leveloffset=+1] @@ -53,6 +54,8 @@ include::elastic-agent-capabilities.asciidoc[leveloffset=+1] include::configuration/env/container-envs.asciidoc[leveloffset=+1] +include::elastic-agent-logging.asciidoc[leveloffset=+1] + include::elastic-agent-standalone-logging.asciidoc[leveloffset=+1] include::redirects.asciidoc[leveloffset=+1] diff --git a/docs/en/ingest-management/images/kibana-fleet-datasets.png b/docs/en/ingest-management/images/kibana-fleet-datasets.png new file mode 100644 index 0000000000..c1d790b5e1 Binary files /dev/null and b/docs/en/ingest-management/images/kibana-fleet-datasets.png differ diff --git a/docs/en/ingest-management/images/kibana-fleet-log-levels.png b/docs/en/ingest-management/images/kibana-fleet-log-levels.png new file mode 100644 index 0000000000..eb4930bc7c Binary files /dev/null and b/docs/en/ingest-management/images/kibana-fleet-log-levels.png differ