elastic / elastic/docs-content

[REQUEST]: Warn/set expectations on migrating Filebeat modules or other Beats products to Elastic Agents

Open
#7,772 1 comment 0 reactions 0 assignees View on GitHub
Team:SKI
Dominant language
No language data
Stars
47
Forks
261
Avg merge
3d 12h
Merged PRs (30d)
116

Description

### Description

We do not provide enough warnings to highlight that migrating from standalone Beats to Elastic Agent might not guarantee the same fields being published to Elasticsearch.
Examples:
- Filebeat/Metricbeat system module to Elastic Agent system integration
- Winlogbeat to Elastic Agent Windows integration

We should:
- Warn the exported fields might not be 1:1 between modules and associated migrations (even within the same version)
- If using Logstash to forward events, there might be some variations between metadata/fields being published
- We mainly "support" using Logstash as forwarder (Elastic Agent -> Logstash -> ... -> Logstash -> ES) keeping data untouched/unmanipulated. Any mutation done in Logstash might prevent ingest pipelines used by integrations to not work properly

### Resources

I think the PM should chime in on how to set correct expectations when migrating from Beats to Elastic Agent.
It should be stated in the docs.
The general feeling is the fields would be 1:1, while it is not always the case.

### Collaboration

TBD. The docs and product team will work together to determine the best path forward.

### Point of contact.

**Main contact:** Elastic Agent PMs, Integrations PMs?

FYI @nimarezainia / @mukeshelastic

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.