Configure logging for standalone Elastic Agents

The Logging section of the elastic-agent.yml config file contains settings for configuring the logging output. The logging system can write logs to the syslog, file, stderr, eventlog, or rotate log files. If you do not explicitly configure logging, the stderr output is used.

This example configures Elastic Agent logging:

agent.logging.level: info
agent.logging.to_files: true
agent.logging.files:
  path: /var/log/elastic-agent
  name: elastic-agent
  keepfiles: 7
  permissions: 0600

You can specify the following settings in the Logging section of the elastic-agent.yml config file.

Some outputs will log raw events on errors like indexing errors in the Elasticsearch output, to prevent logging raw events (that may contain sensitive information) together with other log messages, a different log file, only for log entries containing raw events, is used. It will use the same level, selectors and all other configurations from the default logger, but it will have it’s own file configuration.

Having a different log file for raw events also prevents event data from drowning out the regular log files. Use agent.logging.event_data to configure the events logger.

The events log file is not collected by the Elastic Agent monitoring. If the events log files are needed, they can be collected with the diagnostics or directly copied from the host running Elastic Agent.