elastic / elastic/docs-content
[REQUEST]: Warn/set expectations on migrating Filebeat modules or other Beats products to Elastic Agents
- Dominant language
- No language data
- Stars
- 47
- Forks
- 261
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 116
Description
### Description
We do not provide enough warnings to highlight that migrating from standalone Beats to Elastic Agent might not guarantee the same fields being published to Elasticsearch.
Examples:
- Filebeat/Metricbeat system module to Elastic Agent system integration
- Winlogbeat to Elastic Agent Windows integration
We should:
- Warn the exported fields might not be 1:1 between modules and associated migrations (even within the same version)
- If using Logstash to forward events, there might be some variations between metadata/fields being published
- We mainly "support" using Logstash as forwarder (Elastic Agent -> Logstash -> ... -> Logstash -> ES) keeping data untouched/unmanipulated. Any mutation done in Logstash might prevent ingest pipelines used by integrations to not work properly
### Resources
I think the PM should chime in on how to set correct expectations when migrating from Beats to Elastic Agent.
It should be stated in the docs.
The general feeling is the fields would be 1:1, while it is not always the case.
### Collaboration
TBD. The docs and product team will work together to determine the best path forward.
### Point of contact.
**Main contact:** Elastic Agent PMs, Integrations PMs?
FYI @nimarezainia / @mukeshelastic
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.