From b7ac0ab50ab449850c48b2ada346ce457a6a97a0 Mon Sep 17 00:00:00 2001 From: Karen Metts Date: Fri, 20 Feb 2026 18:56:09 -0500 Subject: [PATCH 1/3] [Agent] New serverless config example for Logstash output 8.19 --- .../outputs/output-logstash.asciidoc | 2 +- .../security/logstash-certificates.asciidoc | 38 +++++++++++++++---- 2 files changed, 32 insertions(+), 8 deletions(-) diff --git a/docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc b/docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc index 6514dcd99..d64c76d3c 100644 --- a/docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc +++ b/docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc @@ -37,7 +37,7 @@ We recommend that the pipeline doesn’t edit or remove the fields and their con Editing the structure of the documents coming from {agent} can prevent the {es} ingest pipelines associated to the integrations in use to work correctly. We cannot guarantee that the {es} ingest pipelines associated to the integrations using {agent} can work with missing or modified fields. -The following {ls} pipeline definition example configures a pipeline that listens on port `5044` for +This {ls} pipeline definition example configures a pipeline that listens on port `5044` for incoming {agent} connections and routes received events to {es}. diff --git a/docs/en/ingest-management/security/logstash-certificates.asciidoc b/docs/en/ingest-management/security/logstash-certificates.asciidoc index 92d59bfbe..e1b3927fe 100644 --- a/docs/en/ingest-management/security/logstash-certificates.asciidoc +++ b/docs/en/ingest-management/security/logstash-certificates.asciidoc @@ -112,12 +112,39 @@ add the following configuration. Replace the path to your file. path.config: "/etc/path/to/elastic-agent-pipeline.conf" ---- -In the `elastic-agent-pipeline.conf` file, add the pipeline configuration. Note -that the configuration needed for {ess} on {ecloud} is different from +In the `elastic-agent-pipeline.conf` file, add the pipeline configuration. +The configuration needed on {ecloud} is different from self-managed {es} clusters. If you copied the configuration shown in {fleet}, adjust it as needed. -{ess} example: +### {es-serverless} example + +[source,text] +---- +input { + elastic_agent { + port => 5044 + ssl_enabled => true + ssl_certificate_authorities => ["/path/to/ca.crt"] + ssl_certificate => "/path/to/logstash.crt" + ssl_key => "/path/to/logstash.pkcs8.key" + ssl_client_authentication => "required" + } +} + +output { + elasticsearch { + hosts => "ELASTICSEARCH_ENDPOINT_URL" <1> + api_key => "xxxx:xxxx" <2> + data_stream => true + } +} +---- +<1> The Elasticsearch endpoint URL for your {es-serverless} project is available in **Application endpoints, cluster and component IDs**. Select **Manage** next to your project to access this information. +<2> In {fleet}, you can generate this API key when you add a {ls} output. + + +### {ech} example [source,text] ---- @@ -137,16 +164,13 @@ output { cloud_id => "xxxx:xxxxxxxxxxxxxxxxxxxxxxxxxxxxx=" <1> api_key => "xxxx:xxxx" <2> data_stream => true - ssl => true <3> } } ---- <1> Use the `cloud_id` shown on your deployment page in {ecloud}. <2> In {fleet}, you can generate this API key when you add a {ls} output. -<3> {ess} uses standard publicly trusted certificates, so there's no need -specify other SSL settings here. -Self-managed {es} cluster example: +=== Self-managed {es} cluster example [source,text] ---- From c6c2a696aa3df381862ab05b4b79c1a0b7b57e4a Mon Sep 17 00:00:00 2001 From: Karen Metts Date: Mon, 23 Feb 2026 14:12:06 -0500 Subject: [PATCH 2/3] Fix new headings --- .../security/logstash-certificates.asciidoc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/en/ingest-management/security/logstash-certificates.asciidoc b/docs/en/ingest-management/security/logstash-certificates.asciidoc index e1b3927fe..655bb8d9f 100644 --- a/docs/en/ingest-management/security/logstash-certificates.asciidoc +++ b/docs/en/ingest-management/security/logstash-certificates.asciidoc @@ -117,7 +117,8 @@ The configuration needed on {ecloud} is different from self-managed {es} clusters. If you copied the configuration shown in {fleet}, adjust it as needed. -### {es-serverless} example +[discrete] +=== {es-serverless} example [source,text] ---- @@ -143,8 +144,8 @@ output { <1> The Elasticsearch endpoint URL for your {es-serverless} project is available in **Application endpoints, cluster and component IDs**. Select **Manage** next to your project to access this information. <2> In {fleet}, you can generate this API key when you add a {ls} output. - -### {ech} example +[discrete] +=== {ech} example [source,text] ---- @@ -170,6 +171,7 @@ output { <1> Use the `cloud_id` shown on your deployment page in {ecloud}. <2> In {fleet}, you can generate this API key when you add a {ls} output. +[discrete] === Self-managed {es} cluster example [source,text] From 6ae817936bd7e60a860ee6efdc083bfb1afe0a20 Mon Sep 17 00:00:00 2001 From: Karen Metts <35154725+karenzone@users.noreply.github.com> Date: Mon, 23 Feb 2026 18:21:34 -0500 Subject: [PATCH 3/3] Update docs/en/ingest-management/security/logstash-certificates.asciidoc Co-authored-by: Janeen Mikell Roberts <57149392+jmikell821@users.noreply.github.com> --- .../ingest-management/security/logstash-certificates.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/en/ingest-management/security/logstash-certificates.asciidoc b/docs/en/ingest-management/security/logstash-certificates.asciidoc index 655bb8d9f..c827443d8 100644 --- a/docs/en/ingest-management/security/logstash-certificates.asciidoc +++ b/docs/en/ingest-management/security/logstash-certificates.asciidoc @@ -141,7 +141,7 @@ output { } } ---- -<1> The Elasticsearch endpoint URL for your {es-serverless} project is available in **Application endpoints, cluster and component IDs**. Select **Manage** next to your project to access this information. +<1> The {es} endpoint URL for your {es-serverless} project is available in **Application endpoints, cluster and component IDs**. Select **Manage** next to your project to access this information. <2> In {fleet}, you can generate this API key when you add a {ls} output. [discrete]