Skip to content

Conversation

btrieger
Copy link

@btrieger btrieger commented Oct 16, 2025

What does this PR do?

This PR adds in the Logstash output for elastic agents to the standalone helm chart.

Why is it important?

Without this, standalone agents cannot connect to Logstash clusters. This makes the chart unusable for end users who have logstash in between agent and elasticsearch.

Checklist

  • I have read and understood the pull request guidelines of this project.
  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in ./changelog/fragments using the changelog tool
  • I have added an integration test or an E2E test

Disruptive User Impact

This should have no user impact and be backward compatable.

How to test this PR locally

Follow steps in examples/kubernetes-logstash-output

Related issues

@btrieger btrieger requested a review from a team as a code owner October 16, 2025 19:52
Copy link
Contributor

mergify bot commented Oct 16, 2025

This pull request does not have a backport label. Could you fix it @btrieger? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

@cmacknz cmacknz added the Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team label Oct 16, 2025
@elasticmachine
Copy link
Collaborator

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

@pierrehilbert
Copy link
Contributor

pierrehilbert commented Oct 17, 2025

Hey @btrieger
Thanks for your contribution.
Could you please add a changelog fragment?

@btrieger
Copy link
Author

@pierrehilbert added the changelog fragment

@btrieger
Copy link
Author

I added the remaining ssl flags and they should work with any of the outputs. I didn't provide an example of using them as I don't have a functioning logstash cluster that needs them but I did validate that they are being set as expected with a template command. Was thinking maybe I could document all the possible input variables outside the values schema json for every day users. Would it be best to put this in the examples readme for logstash?

On a side note the rest of the outputs should remove the fromYaml and toYaml around the the call to the SSLConfig rendering as it removes the quotes and in the case of ca fingerprints this could prove problematic.

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

History

cc @btrieger

Copy link
Contributor

@pkoutsovasilis pkoutsovasilis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for the contribution @btrieger . This is a big one so I will have to go through that one more time but in the meantime I left some comments. Also please any change that you do for the k8s templates try to introduce it also for the eck ones, from what I can tell everything here is compatible with both

Comment on lines 159 to 167
{{- with index $outputVal "queue.mem.flush.timeout" }}
queue.mem.flush.timeout: {{. | quote}}
{{- end }}
{{- with index $outputVal "queue.mem.flush.min_events" }}
queue.mem.flush.min_events: {{.}}
{{- end }}
{{- with index $outputVal "queue.mem.events" }}
queue.mem.events: {{.}}
{{- end }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe that there shouldn't be any fields with dot notation in them here. If a user sets through cli such values they will appear as proper yaml and then this here won't work

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be best to build out the schema to make them all objects? I think it is best to keep variable names in line with what they are in our docs for clarity? You can still set these via the cli if you use quotes around the variable name. I have done it with other charts in the past.

Speaking of keeping variable names in line. What are your thoughts on making a 2nd copy of certificate_authorities and verification_mode and deprecating the others. I would make a clean switch but don't want to break anyones chart that is using this one.

Copy link
Contributor

@pkoutsovasilis pkoutsovasilis Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be best to build out the schema to make them all objects? I think it is best to keep variable names in line with what they are in our docs for clarity?

yes they are like that in our docs but elastic-agent does under the hood the splitting up of dot notation, I do believe that is more error prone to say to the user that a key has to wrapped across some quotes for it to find it's appropriate place in the values, thus I am inclining of saying to expand all of them as objects

Speaking of keeping variable names in line. What are your thoughts on making a 2nd copy of certificate_authorities and verification_mode and deprecating the others. I would make a clean switch but don't want to break anyones chart that is using this one.

sure mark the existing ones as deprecated but they still have to render properly and after some versions these can go away

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think doing the deprecation may be best in a separate PR otherwise this one will get event longer. I have made the other changes suggested.

Comment on lines 177 to 182
{{- with index $outputVal "backoff.max" }}
backoff.max: {{. | quote }}
{{- end }}
{{- with index $outputVal "backoff.init" }}
backoff.init: {{. | quote }}
{{- end }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ditto

@btrieger
Copy link
Author

@pkoutsovasilis will do I was tyring to keep it small but it seemed kind of unavoidable if I wanted to add all the variables available for logstash.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants