Skip to content

Latest commit

 

History

History
126 lines (92 loc) · 3.86 KB

elastic-agent-providers.asciidoc

File metadata and controls

126 lines (92 loc) · 3.86 KB

Configure providers for standalone {agent}s

Providers

Providers supply the key-value pairs that are used for variable substitution and conditionals. Each provider’s keys are automatically prefixed with the name of the provider in the context of the {agent}.

For example, a provider named foo provides {"key1": "value1", "key2": "value2"}, the key-value pairs are placed in {"foo" : {"key1": "value1", "key2": "value2"}}. To reference the keys, use {{foo.key1}} and {{foo.key2}}.

Provider configuration

The provider configuration is specified under the top-level providers key in the elastic-agent.yml configuration. All registered providers are enabled by default. If a provider cannot connect, no mappings are produced.

The following example shows two providers (local and local_dynamic) that supply custom keys:

providers:
  local:
    vars:
      foo: bar
  local_dynamic:
    vars:
      - item: key1
      - item: key2

Providers are enabled automatically if a provider is referenced in an {agent} policy. All providers are prefixed without name collisions. The name of the provider is in the key in the configuration.

providers:
  docker:
    enabled: false

{agent} supports two broad types of providers: context and dynamic.

Context providers

Context providers give the current context of the running {agent}, for example, agent information (ID, version), host information (hostname, IP addresses), and environment information (environment variables).

They can only provide a single key-value mapping. Think of them as singletons; an update of a key-value mapping results in a re-evaluation of the entire configuration. These providers are normally very static, but not required. A value can change which results in re-evaluation.

Context providers use the Elastic Common Schema (ECS) naming to ensure consistency and understanding throughout documentation and projects.

{agent} supports the following context providers:

Dynamic Providers

Dynamic providers give an array of multiple key-value mappings. Each key-value mapping is combined with the previous context provider’s key and value mapping which provides a new unique mapping that is used to generate a configuration.

{agent} supports the following context providers:

Disabling Providers By Default

All registered providers are disabled by default until they are referenced in a policy.

You can disable all providers even if they are referenced in a policy by setting agent.providers.initial_default: false.

The following configuration disables all providers from running except for the docker provider, if it becomes referenced in the policy:

agent.providers.initial_default: false
providers:
  docker:
    enabled: true