Configuring data streams created by Elastic Agentedit
When monitoring using Elastic Agent, data is stored in a
set of data streams named
metrics-{product}.stack_monitoring.{dataset}-{namespace}. For example:
metrics-elasticsearch.stack_monitoring.shard-default.
The settings and mappings for these data streams are determined by an index
template named metrics-{product}.stack_monitoring.{dataset}. For example:
metrics-elasticsearch.stack_monitoring.shard.
To change the settings of each data stream, edit the
metrics-{product}.stack_monitoring.{dataset}@custom component template that
already exists. You can do this in Kibana:
- Navigate to Stack Management > Index Management > Component Templates.
- Search for the component template.
- Select the Edit action.
You can also use the Elasticsearch API:
- Retrieve the component template using the get component template API.
- Edit the component template.
- Store the updated component template using the update component template API.
After changing the component template, the updated settings are only applied to the data stream’s new backing indices. Roll over the data stream to immediately apply the updated settings to the data stream’s write index.