Add internal configuration to select runtime by output

[khushijain21]

What does this PR do?

This PR adds agent.internal.runtime.output setting to allow selecting runtime based on output.

agent:
  internal:
    runtime:
      default: process
      filebeat:
        filestream: otel
      metricbeat:
        system/metrics: otel
      output: # Override the runtime used based on the output type.
        elasticsearch: otel # Force all inputs using the Elasticearch output to use the otel runtime (if possible - cannot select otel for inputs that don't support it)
        logstash: process # Force all inputs using the Logstash output to use the process runtime
        kafka: process # Force all inputs using the kafka output to use the process runtime

Why is it important?

This is required to add support for logstash output in OTel mode and have the ability to switch runtimes.

Checklist

• I have read and understood the pull request guidelines of this project.
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool
• I have added an integration test or an E2E test

Disruptive User Impact

None

How to test this PR locally

Configure system/metrics input with logstash output. Instead of starting the Otel runtime, system/metrics will now run using process runtime

outputs:
  default:
    type: logstash

inputs:
  - type: system/metrics
    id: unique-system-metrics-input
    data_stream.namespace: default
    use_output: default
    streams:
      - metricsets:
        - cpu
        data_stream.dataset: system.cpu
      - metricsets:
        - memory
        data_stream.dataset: system.memory
      - metricsets:
        - network
        data_stream.dataset: system.network
      - metricsets:
        - filesystem
        data_stream.dataset: system.filesystem

Related issues

• Closes [beats receivers] Add internal configuration option to select the runtime by output #12823
• Required by Add translation logic for logstash output #12739

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b internal.output upstream/internal.output
git merge upstream/main
git push upstream internal.output

[mergify]

This pull request does not have a backport label. Could you fix it @khushijain21? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[elasticmachine]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[cmacknz]

Let's document this in https://github.com/elastic/elastic-agent/blob/main/docs/hybrid-agent-beats-receivers.md#beat-receivers-for-data-collection

[github-actions]

🔍 Preview links for changed docs

• docs/hybrid-agent-beats-receivers.md

[cmacknz]

If I do the following, I get the system/metrics input using the process runtime which is not what I expected. I expected the output to take precedence.

agent.internal:
  runtime:
    filebeat:
      filestream: otel
    metricbeat:
      system/metrics: process
    output:
      elasticsearch: otel

Details

~/Downloads/builds/elastic-agent-9.4.0-SNAPSHOT-darwin-aarch64 ······································ 12:14:12 PM
❯ sudo elastic-development-agent version
Binary: 9.4.0-SNAPSHOT (build: 4bd82471639ef2238a1beaa37a32335b374a6686 at 2026-02-20 16:45:23 +0000 UTC)
Daemon: 9.4.0-SNAPSHOT (build: 4bd82471639ef2238a1beaa37a32335b374a6686 at 2026-02-20 16:45:23 +0000 UTC)
~/Downloads/builds/elastic-agent-9.4.0-SNAPSHOT-darwin-aarch64 ······································ 12:14:17 PM
❯ sudo elastic-development-agent inspect
agent:
  internal:
    runtime:
      filebeat:
        filestream: otel
      metricbeat:
        system/metrics: process
      output:
        elasticsearch: otel
  logging:
    to_stderr: true
inputs:
- data_stream:
    namespace: default
  id: unique-system-metrics-input
  streams:
  - data_stream:
      dataset: system.cpu
  type: system/metrics
  use_output: default
- id: your-input-id
  streams:
  - data_stream:
      dataset: generic
    id: your-filestream-stream-id
    paths:
    - /var/log/*.log
  type: filestream
outputs:
  default:
    api_key: <REDACTED>
    hosts:
    - 127.0.0.1:9200
    preset: balanced
    type: elasticsearch
~/Downloads/builds/elastic-agent-9.4.0-SNAPSHOT-darwin-aarch64 ······································ 12:14:21 PM
❯ sudo elastic-development-agent status --output=yaml
state: 3
message: 1 or more components/units in a degraded state
components:
- id: beat/metrics-monitoring
  name: beat/metrics
  state: 3
  message: 'Recoverable: Elasticsearch request failed: dial tcp 127.0.0.1:9200: connect:
    connection refused'
  units:
  - unit_id: beat/metrics-monitoring
    unit_type: 1
    state: 3
    message: 'Recoverable: Elasticsearch request failed: dial tcp 127.0.0.1:9200:
      connect: connection refused'
  - unit_id: beat/metrics-monitoring-metrics-monitoring-beats
    unit_type: 0
    state: 2
    message: ""
  version_info:
    name: beats-receiver
    meta:
      build_time: 2026-02-20 16:45:23 +0000 UTC
      commit: 4bd82471639ef2238a1beaa37a32335b374a6686
- id: filestream-default
  name: filestream
  state: 3
  message: 'Recoverable: Elasticsearch request failed: dial tcp 127.0.0.1:9200: connect:
    connection refused'
  units:
  - unit_id: filestream-default
    unit_type: 1
    state: 3
    message: 'Recoverable: Elasticsearch request failed: dial tcp 127.0.0.1:9200:
      connect: connection refused'
  - unit_id: filestream-default-your-input-id
    unit_type: 0
    state: 2
    message: ""
  version_info:
    name: beats-receiver
    meta:
      build_time: 2026-02-20 16:45:23 +0000 UTC
      commit: 4bd82471639ef2238a1beaa37a32335b374a6686
- id: filestream-monitoring
  name: filestream
  state: 3
  message: 'Recoverable: Elasticsearch request failed: dial tcp 127.0.0.1:9200: connect:
    connection refused'
  units:
  - unit_id: filestream-monitoring
    unit_type: 1
    state: 3
    message: 'Recoverable: Elasticsearch request failed: dial tcp 127.0.0.1:9200:
      connect: connection refused'
  - unit_id: filestream-monitoring-filestream-monitoring-agent
    unit_type: 0
    state: 2
    message: Healthy
  version_info:
    name: beats-receiver
    meta:
      build_time: 2026-02-20 16:45:23 +0000 UTC
      commit: 4bd82471639ef2238a1beaa37a32335b374a6686
- id: http/metrics-monitoring
  name: http/metrics
  state: 3
  message: 'Recoverable: Elasticsearch request failed: dial tcp 127.0.0.1:9200: connect:
    connection refused'
  units:
  - unit_id: http/metrics-monitoring
    unit_type: 1
    state: 3
    message: 'Recoverable: Elasticsearch request failed: dial tcp 127.0.0.1:9200:
      connect: connection refused'
  - unit_id: http/metrics-monitoring-metrics-monitoring-agent
    unit_type: 0
    state: 2
    message: Healthy
  version_info:
    name: beats-receiver
    meta:
      build_time: 2026-02-20 16:45:23 +0000 UTC
      commit: 4bd82471639ef2238a1beaa37a32335b374a6686
- id: system/metrics-default
  name: system/metrics
  state: 2
  message: 'Healthy: communicating with pid ''32675'''
  units:
  - unit_id: system/metrics-default
    unit_type: 1
    state: 2
    message: Healthy
  - unit_id: system/metrics-default-unique-system-metrics-input
    unit_type: 0
    state: 2
    message: Healthy
  version_info:
    name: beat-v2-client
    meta:
      build_time: 0001-01-01 00:00:00 +0000 UTC
      commit: unknown
fleet_state: 6
fleet_message: Not enrolled into Fleet
collector:
  status: 3
  error: 'Elasticsearch request failed: dial tcp 127.0.0.1:9200: connect: connection
    refused'
  timestamp: 2026-02-20T12:10:30.780071-05:00

</details?

[khushijain21]

@cmacknz can you take a look again. The above bug surprisingly didn't get caught in existing UT - fixed that too

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 1d70582

History

• 💔 Build #35030 failed 3299a6b
• 💛 Build #34927 was flaky 4bd8247
• 💔 Build #34912 failed acfa95a
• 💔 Build #34910 failed f94c70d

cc @khushijain21