Add an OTel Collector in Fleet

Start adding a collector

1. In Kibana, enter Fleet in the global search field, then select Fleet / Agents.
2. Click Add, then select Collector (OpAMP) from the list.

A flyout opens where you can enter metadata for your OTel Collector and preview the generated configuration.

Enter collector metadata

Provide values for the fields in the flyout. Fleet uses them to populate the OpAMP identity attributes and internal telemetry resource attributes in the generated configuration.

A generated configuration preview appears when all required fields contain valid values.

Supply an Elasticsearch API key

Choose how to provide an Elasticsearch API key for the elasticsearch/otel exporter:

• Create one in the flyout: Click Create API key. Fleet creates an API key with default privileges and substitutes it for ${API_KEY} in the generated configuration.
• Use an existing key: Skip this action in the flyout, and replace ${API_KEY} manually after copying the configuration in the next step. The key must have create_index, write, and auto_configure index privileges on metrics-*, logs-*, and traces-* data streams.

Apply the configuration

1. Copy the YAML configuration displayed in the flyout, or click Download config to save it as a YAML file. The snippet wires the OpAMP extension to Fleet Server, sets up an OTLP receiver and OTLP-to-Elasticsearch pipelines, and adds internal telemetry configuration.

   Note

   If you already have a working OTel Collector with an Elasticsearch exporter, merge the generated configuration into your existing setup instead of replacing the whole file. Remove the elasticsearch/otel exporter block and adjust the pipelines to use your existing exporter.

   Generated OTel Collector configuration

   extensions:
     opamp:
       server:
         http:
           endpoint: "https://<fleet-server-host-url>/v1/opamp"
           headers:
             Authorization: "ApiKey <fleet-enrollment-api-key>"
           tls:
             insecure_skip_verify: true
       instance_uid: "<instance-uid>"
       agent_description:
         non_identifying_attributes:
           elastic.collector.group_name: "OTel Collector Group"
           elastic.collector.group: "otel-collector-group"
           elastic.display.name: "${env:HOSTNAME}"
   
   receivers:
     otlp:
       protocols:
         grpc:
           endpoint: "0.0.0.0:4317"
   
   exporters:
     elasticsearch/otel:
       endpoints:
         - "https://<elasticsearch-host-url>"
       api_key: "${API_KEY}"
       mapping:
         mode: otel
     otlp:
       endpoint: "http://localhost:4317"
       tls:
         insecure: true
   
   service:
     extensions: [opamp]
     pipelines:
       logs:
         receivers: [otlp]
         exporters: [elasticsearch/otel]
       metrics:
         receivers: [otlp]
         exporters: [elasticsearch/otel]
       traces:
         receivers: [otlp]
         exporters: [elasticsearch/otel]
     telemetry:
       resource:
         elastic.collector.group_name: "OTel Collector Group"
         elastic.collector.group: "otel-collector-group"
         service.namespace: "otel-collector-group"
         service.name: "otel-collector-group"
         service.instance.id: "${env:HOSTNAME}"
       metrics:
         readers:
           - periodic:
               exporter:
                 otlp:
                   protocol: grpc
                   endpoint: "http://localhost:4317"
       logs:
         processors:
           - batch:
               exporter:
                 otlp:
                   protocol: grpc
                   endpoint: "http://localhost:4317"
       traces:
         processors:
           - batch:
               exporter:
                 otlp:
                   protocol: grpc
                   endpoint: "http://localhost:4317"
   		

   1. The Fleet Server host URL with the OpAMP endpoint, automatically populated by Fleet.
   2. An enrollment API key, automatically populated by Fleet.
   3. Skips verification of the Fleet Server TLS certificate. Before deploying to production, adjust the configuration to use a CA file as described in Configure TLS for Fleet Server connection.
   4. A UUID v7 instance identifier, automatically generated by Fleet.
   5. Identity attributes populated from the form fields you provided in the previous step.
   6. The Elasticsearch endpoint, automatically populated from your default Fleet output.
   7. The Elasticsearch API key. If you used Create API key, Fleet replaces ${API_KEY} with the generated key. Otherwise, replace ${API_KEY} manually with your existing encoded key.

2. Paste or merge the configuration into your OTel Collector configuration file (for example, otel.yaml).

3. Make sure every environment-variable placeholder in the configuration resolves at runtime:

   • ${API_KEY}: replace it with your encoded Elasticsearch API key value, or set the API_KEY environment variable before starting or restarting the collector.
   • ${env:HOSTNAME}: make sure HOSTNAME is set in the collector's runtime environment, or replace the placeholder with a static identifier.

4. Save your configuration.

Verify the collector connection

1. Start or restart your OTel Collector with the applied configuration.
2. Return to the Fleet UI. The flyout displays a confirmation message when your collector successfully connects.
3. Your OTel Collector now appears in the Agents list.