{"id":13666273,"url":"https://github.com/elastic/elastic-agent","last_synced_at":"2026-02-03T17:09:59.416Z","repository":{"id":36969342,"uuid":"436282917","full_name":"elastic/elastic-agent","owner":"elastic","description":"Elastic Agent - single, unified way to add monitoring for logs, metrics, and other types of data to a host.","archived":false,"fork":false,"pushed_at":"2025-05-12T11:07:09.000Z","size":383298,"stargazers_count":173,"open_issues_count":601,"forks_count":164,"subscribers_count":233,"default_branch":"main","last_synced_at":"2025-05-12T12:24:53.811Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/elastic.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.asciidoc","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2021-12-08T14:46:01.000Z","updated_at":"2025-05-10T01:41:45.000Z","dependencies_parsed_at":"2023-09-25T07:26:34.309Z","dependency_job_id":"4776579c-f887-467f-8c2a-4300b4241160","html_url":"https://github.com/elastic/elastic-agent","commit_stats":{"total_commits":14442,"total_committers":744,"mean_commits":"19.411290322580644","dds":0.9061764298573605,"last_synced_commit":"8e31a5ddd13daf27bd0186488af4faab6283e5d1"},"previous_names":[],"tags_count":75,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Felastic-agent","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Felastic-agent/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Felastic-agent/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elastic%2Felastic-agent/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/elastic","download_url":"https://codeload.github.com/elastic/elastic-agent/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254270640,"owners_count":22042858,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T06:01:14.066Z","updated_at":"2026-01-16T07:17:59.440Z","avatar_url":"https://github.com/elastic.png","language":"Go","funding_links":[],"categories":["Elastic Stack"],"sub_categories":[],"readme":"# Elastic Agent\n\n[![Build status](https://badge.buildkite.com/1d35bb40427cc6833979645b61ea214fc4b686a2ffe3a68bdf.svg)](https://buildkite.com/elastic/elastic-agent)\n\n## Architecture and Internals\n\n- [Agent architecture](docs/architecture.md)\n- [Component spec files](docs/component-specs.md)\n- [Policy configuration](docs/agent-policy.md)\n\n## Official Documentation\n\nSee https://www.elastic.co/guide/en/fleet/current/index.html.\n\nThe source files for the official Elastic Agent documentation are currently stored\nin the [ingest-docs](https://github.com/elastic/ingest-docs/tree/main/docs/en/ingest-management) repository.\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## Developing\n\nThe following are exclusively focused on getting developers started building code for Elastic Agent.\n\n### Development Installations\n\n\u003e :warning: Development installations are not officially supported and are intended for Elastic Agent developers.\n\nIf you are an Elastic employee, you already have an Information Security managed Elastic Agent installed on your machine for endpoint protection.\nThis prevents you from installing the Elastic Agent a second time for development without using a VM or Docker container. To eliminate this point\nof friction, Elastic Agent has a development mode that permits installing the Elastic Agent on your machine a second time:\n\n```sh\n# All other arguments to the install command are still supported when --develop is specified.\nsudo ./elastic-agent install --develop\n# The run command also supports the --develop option to allow running without installing when there is another agent on the machine.\n./elastic-agent run -e --develop\n```\n\nUsing the `--develop` option will install the agent in an isolated `Agent-Development` agent directory in the chosen base path.\nDevelopment agents enrolled in Fleet will have the `Development` tag added automatically. Using the default base path on MacOS you will see:\n\n```sh\nsudo ls /Library/Elastic/\nAgent\nAgent-Development\n```\n\nThe `elastic-agent` command in the shell is replaced with `elastic-development-agent` to interact with the development agent:\n\n```sh\n# For a privileged agent\nsudo elastic-development-agent status\n# For an unprivileged agent\nsudo -u elastic-agent-user elastic-development-agent status\n```\n\nThe primary restriction of `--develop` installations is that they cannot run Elastic Defend. Defend requires the agent to be\nin the default path, the same restrictions applies for the `--base-path` option. All other integrations should be usable provided\nconflicting configurations are changed ahead of time. For example two agents cannot bind to the same `agent.monitoring.http.port`\nto expose their monitoring servers.\n\n### Test Framework\n\nIn addition to standard Go tests, changes to the Elastic Agent are always installed and tested on cross-platform virtual machines.\nFor details on writing and running tests see the [Test Framework Developer Guide](docs/test-framework-dev-guide.md).\n\n### Changelog\n\nThe changelog for the Elastic Agent is generated and maintained using the [elastic-agent-changelog-tool](https://github.com/elastic/elastic-agent-changelog-tool). Read the [installation](https://github.com/elastic/elastic-agent-changelog-tool/blob/main/docs/install.md)\nand [usage](https://github.com/elastic/elastic-agent-changelog-tool/blob/main/docs/usage.md#im-a-developer) instructions to get started.\n\nThe changelog tool produces fragment files that are consolidated to generate a changelog for each release. Each PR containing a change with user\nimpact (new feature, bug fix, etc.) must contain a changelog fragment describing the change. There is a GitHub action in CI that will fail\nif a PR does not contain a changelog fragment. For PRs that should not have a changelog entry, use the \"skip-changelog\" label to bypass\nthis check.\n\nA simple example of a changelog fragment is below for reference:\n\n```yml\nkind: bug-fix\nsummary: Fix a panic caused by a race condition when installing the Elastic Agent.\npr: https://github.com/elastic/elastic-agent/pull/823\n```\n\n### Packaging\n\nPrerequisites:\n- Running `git submodule update --init` once after cloning or pulling the beats submodule for the first time.\n- installed [mage](https://github.com/magefile/mage)\n- [Docker](https://docs.docker.com/get-docker/)\n- [beats](https://github.com/elastic/beats) to pre-exist in the parent folder of the local Git repository checkout if, and only if, packaging with `EXTERNAL=false` to package the beats as well\n- [elastic-agent-changelog-tool](https://github.com/elastic/elastic-agent-changelog-tool) to add changelog fragments for changelog generation\n\nTo build a local version of the agent for development, run the command below. The following platforms are supported:\n* darwin/amd64\n* darwin/arm64\n* linux/amd64\n* linux/arm64\n* windows/amd64\n\n```sh\n# EXTERNAL=true downloads the matching version of the binaries that are packaged with agent, not necessary if only using Beats.\n# SNAPSHOT=true indicates that this is a snapshot version and not a release version.\n# PLATFORMS=linux/amd64 builds an agent that will run on 64 bit X86 Linux systems.\n# PACKAGES=tar.gz produces a tar.gz package\nEXTERNAL=true SNAPSHOT=true PLATFORMS=linux/amd64 PACKAGES=tar.gz mage -v package\n```\n\nThe resulting package will be produced in the build/distributions directory. The version is controlled by the value in [version.go](version/version.go).\nTo install the agent extract the package and run the install command:\n\n```sh\ncd build/distributions\ntar xvfz build/distributions/elastic-agent-8.8.0-SNAPSHOT-darwin-aarch64.tar.gz\ncd build/distributions/elastic-agent-8.8.0-SNAPSHOT-darwin-aarch64\nsudo elastic-agent install\n```\n\nFor basic use the agent binary can be run directly, with the `sudo elastic-agent run` command.\n\n#### Packaging for other architectures\nWhen packaging for an architecture different than the host machine,\nyou might face the following error:\n```\nexec /crossbuild: exec format error\n```\n\nIf that happens, enable\n[`multiarch/qemu-user-static`](https://github.com/multiarch/qemu-user-static)\nis to enable an execution of different multi-architecture containers\nby QEMU and binfmt_misc:\n\n```\ndocker run --rm --privileged multiarch/qemu-user-static --reset -p yes\n```\n\n### Docker\n\nRunning Elastic Agent in a docker container is a common use case. To build the Elastic Agent and create a docker image run the following command:\n\n```\n# Use PLATFORMS=linux/arm64 if you are using an ARM based Mac.\nDEV=true SNAPSHOT=true PLATFORMS=linux/amd64 PACKAGES=docker mage package\n```\n\nIf you are in the 7.13 branch, this will create the `docker.elastic.co/beats/elastic-agent:7.13.0-SNAPSHOT` image in your local environment. Now you can use this to for example test this container with the stack in elastic-package:\n\n```\nelastic-package stack up --version=7.13.0-SNAPSHOT -v\n```\n\nPlease note that the docker container is built in standard, 'service', 'cloud' and 'complete' variants. The variants technical specificities can be found [here](https://github.com/elastic/elastic-agent/blob/main/dev-tools/packaging/templates/docker/Dockerfile.elastic-agent.tmpl).\n- The 'service' variant contains python libs and connectors that allows it to collect data using [search_connectors](https://www.elastic.co/guide/en/enterprise-search/current/connectors.html).\n- The 'cloud' variant is the one used for ESS deployment.\n- The 'complete' variant contains extra files, like the chromium browser, that are too large\nfor the standard variant which allows this docker image to run Synthetics.\n\n\n### Testing Elastic Agent on Kubernetes\n\n#### Prerequisites\n- create kubernetes cluster using kind, check [here](https://github.com/elastic/beats/blob/main/metricbeat/module/kubernetes/_meta/test/docs/README.md) for details\n- deploy kube-state-metrics, check [here](https://github.com/elastic/beats/blob/main/metricbeat/module/kubernetes/_meta/test/docs/README.md) for details\n- deploy required infrastructure:\n    - for elastic agent in standalone mode: EK stack or use [elastic cloud](https://cloud.elastic.co), check [here](https://github.com/elastic/beats/blob/main/metricbeat/module/kubernetes/_meta/test/docs/README.md) for details\n    - for managed mode: use [elastic cloud](https://cloud.elastic.co) or bring up the stack on docker and then connect docker network with kubernetes kind nodes:\n  ```\n  elastic-package stack up -d -v\n  docker network connect elastic-package-stack_default \u003ckind_container_id\u003e\n  ```\n\n1. Build elastic-agent:\n```bash\nDEV=true PLATFORMS=linux/amd64 PACKAGES=docker mage package\n```\n\nUse environmental variables `GOHOSTOS` and `GOHOSTARCH` to specify PLATFORMS variable accordingly. eg.\n```bash\n❯ go env GOHOSTOS\ndarwin\n❯ go env GOHOSTARCH\namd64\n```\n\n2. Build docker image:\n```bash\ncd build/package/elastic-agent/elastic-agent-linux-amd64.docker/docker-build\ndocker build -t custom-agent-image .\n```\n3. Load this image in your kind cluster:\n```\nkind load docker-image custom-agent-image:latest\n```\n4. Deploy agent with that image:\n- download all-in-ome manifest for elastic-agent in standalone or managed mode, change version if needed\n```\nELASTIC_AGENT_VERSION=\"8.0\"\nELASTIC_AGENT_MODE=\"standalone\"     # ELASTIC_AGENT_MODE=\"managed\"\ncurl -L -O https://raw.githubusercontent.com/elastic/elastic-agent/${ELASTIC_AGENT_VERSION}/deploy/kubernetes/elastic-agent-${ELASTIC_AGENT_MODE}-kubernetes.yaml\n```\n- Modify downloaded manifest:\n    - change image name to the one, that was created in the previous step and add `imagePullPolicy: Never`:\n    ```\n    containers:\n      - name: elastic-agent\n        image: custom-agent-image:latest\n        imagePullPolicy: Never\n    ```\n    - set environment variables accordingly to the used setup.\n\n  Elastic-agent in standalone mode: set `ES_USERNAME`, `ES_PASSWORD`,`ES_HOST`.\n\n  Elastic-agent in managed mode: set `FLEET_URL` and `FLEET_ENROLLMENT_TOKEN`.\n\n- create\n```\nkubectl apply -f elastic-agent-${ELASTIC_AGENT_MODE}-kubernetes.yaml\n```\n5. Check status of elastic-agent:\n```\nkubectl -n kube-system get pods -l app=elastic-agent\n```\n\n## Testing on Elastic Cloud\n\nElastic employees can create an Elastic Cloud deployment with a locally\nbuilt Elastic Agent, by pushing images to an internal Docker repository. The images will be\nbased on the SNAPSHOT images with the version defined in `version/version.go`.\n\nPrerequisite to running following commands is having `terraform` installed and running `terraform init` from within `testing/environments/cloud`.\n\nRunning a shorthand `make deploy_local` in `testing/environments/cloud` will build Agent, tag the docker image correctly, push it to the repository and deploy to Elastic Cloud.\n\nFor more advanced scenarios:\nRunning `make build_elastic_agent_docker_image` in `testing/environments/cloud` will build and push the images.\nRunning `make push_elastic_agent_docker_image` in `testing/environments/cloud` will publish built docker image to CI docker repository.\n\nOnce docker images are published you can run `EC_API_KEY=your_api_key make apply` from `testing/environments/cloud` directory to deploy them to Elastic Cloud.\nTo get `EC_API_KEY` follow [this guide](https://www.elastic.co/guide/en/cloud/current/ec-api-authentication.html)\n\nThe custom images are tagged with the current version, commit and timestamp. The\ntimestamp is included to force a new Docker image to be used, which enables pushing new\nbinaries without recreating the deployment.\n\nTo specify custom images create your `docker_image.auto.tfvars` file similar to `docker_image.auto.tfvars.sample`.\n\nYou can also use `mage cloud:image` and `mage cloud:push` respectively from repo root directory.\nTo deploy your changes use `make apply` (from `testing/environments/cloud`) with `EC_API_KEY` instead of `make deploy_local` described above.\n\nSNAPSHOT images are used by default. To use non-snapshot image specify `SNAPSHOT=false` explicitly.\n\n## Updating dependencies/PRs\nEven though we prefer `mage` to our automation, we still have some\nrules implemented on our `Makefile` as well as CI will use the\n`Makefile`. CI will run `make check-ci`, so make sure to run it\nlocally before submitting any PRs to have a quicker feedback instead\nof waiting for a CI failure.\n\n### Keeping Go module files tidy\nThe Elastic Agent repository includes additional Go modules (e.g. `wrapper/windows/archive-proxy`) that import the main `elastic-agent` module. This requires keeping all `go.mod` files in sync whenever dependencies change. There is a dedicated `mage tidy` target that recursively runs `go mod tidy` across the entire repo. This is now handled automatically in the following targets:\n- `mage check`\n- `mage notice`\n- `mage update`\n\n### Generating the `NOTICE.txt` and `NOTICE-fips.txt` when updating/adding dependencies\nTo do so, just run `mage notice`, this is also part of the `make\ncheck-ci` and is the same check our CI will do.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felastic%2Felastic-agent","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Felastic%2Felastic-agent","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felastic%2Felastic-agent/lists"}