Ingest metrics
You can send metrics to Elastic over the OpenTelemetry Protocol (OTLP), with Elastic Agent integrations, or with Prometheus remote write:
- OTLP: Recommended in most cases.
- Elastic Agent integrations: Use when you need existing Elastic Common Schema (ECS) integrations, dashboards, and alerts to keep working without customization.
- Prometheus metrics: Use when Prometheus already scrapes the metrics you need.
To understand when classic Elastic components, such as Elastic Agent integrations, Metricbeat, and Elastic APM agents, are a better fit, refer to Know when to keep using classic Elastic components.
Elastic supports and recommends using the Elastic OpenTelemetry distribution to send your metric data to Elasticsearch, and the quickstarts use it. The endpoint you send data to depends on your deployment type.
Send metrics to the Managed OTLP Endpoint. Use the setup that matches the source of your metrics:
- Application metrics: Point your EDOT SDKs or any OTLP-compatible exporter directly at the endpoint. No Elastic Agent required.
- Infrastructure metrics (host, Kubernetes, Docker): Run Elastic Agent configured as an OTel Collector on your hosts or cluster and point its OTLP exporter at the endpoint. The quickstarts set this up for you. For the exporter and pipeline configuration, refer to Using the Managed OTLP Endpoint.
The Elasticsearch OTLP endpoint isn't a supported ingest path on Elastic Cloud Serverless: use the Managed OTLP Endpoint instead. For authentication, endpoint URL, and protocol details, refer to Managed OTLP Endpoint.
Send metrics to the Managed OTLP Endpoint. Use the setup that matches the source of your metrics:
- Application metrics: Point your EDOT SDKs or any OTLP-compatible exporter directly at the endpoint. No Elastic Agent required.
- Infrastructure metrics (host, Kubernetes, Docker): Run Elastic Agent configured as an OTel Collector on your hosts or cluster and point its OTLP exporter at the endpoint. The quickstarts set this up for you. For the exporter and pipeline configuration, refer to Using the Managed OTLP Endpoint.
The Elasticsearch OTLP endpoint isn't a supported ingest path on Elastic Cloud Hosted: use the Managed OTLP Endpoint instead. For authentication, endpoint URL, and protocol details, refer to Managed OTLP Endpoint.
Run Elastic Agent configured as an OTel Collector gateway. The gateway exposes an OTLP endpoint that your EDOT SDKs and edge collectors send to, and it writes to Elasticsearch with the elasticsearch exporter. For gateway versus edge setup, refer to Elastic Agent deployment modes.
The elasticsearch exporter drops histograms with cumulative temporality, the default in most OpenTelemetry SDKs. Export histograms with delta temporality, add the cumulativetodelta processor to the gateway, or send metrics to /_otlp, which accepts both temporalities from 9.5. For temporality support by deployment type, refer to Histogram and counter temporality.
/_otlp/v1/metrics from a gateway Collector. Use it when that gateway prefers the OTLP/HTTP exporter over the elasticsearch exporter. Don't send applications or pods directly to /_otlp. Metrics land in a time series data stream (TSDS) through built-in index templates. Refer to Ingest metrics into a TSDS using the OTLP/HTTP endpoint for how metrics are stored and to Elasticsearch OTLP/HTTP endpoint for request details.
Use Elastic Agent integrations to collect metrics from specific infrastructure components and services, for example system metrics from hosts, Kubernetes cluster metrics, or metrics from Nginx, PostgreSQL, or Redis. Integrations store ECS documents and send them to the output you configure in Fleet, where you manage Elastic Agent policies in Kibana. That output is Elasticsearch by default. The data doesn't go through the Managed OTLP Endpoint and isn't converted to OTLP.
Use this path when you need existing ECS integrations, dashboards, and alerts to keep working without customization. To collect host metrics this way, follow Get started with system metrics. To find which services have a prebuilt integration, browse the Integrations catalog.
Some services have both an ECS integration and an OpenTelemetry integration, for example Nginx and Nginx (OpenTelemetry). The (OpenTelemetry) integration is an OpenTelemetry input package: a Fleet-managed Elastic Agent runs the matching OTel Collector receiver. The integration without (OpenTelemetry) is the ECS integration.
| Aspect | ECS integration | OpenTelemetry integration |
|---|---|---|
| Stores data with | ECS field names | OpenTelemetry semantic conventions |
| Prebuilt content | The integration's ECS dashboards and alerts | Dashboards from the matching OpenTelemetry content pack, which Kibana installs |
| Use when | You need the integration's ECS dashboards and alerts | You standardize on the OpenTelemetry schema and manage agents with Fleet |
OpenTelemetry input packages run only on Elastic Agent in its default mode, not on Elastic Agent configured as an OTel Collector. Refer to Collect OpenTelemetry data with Elastic Agent integrations for how to set up an OpenTelemetry input package.
Metricbeat, the standalone Beats shipper for metrics, writes ECS documents. While it isn't deprecated, we recommend that new setups use Elastic Agent instead: configured as an OTel Collector for the OpenTelemetry schema, or with integrations for ECS. If you already run Metricbeat, refer to Move from Metricbeat or Elastic Agent integrations for how to switch to OpenTelemetry.
If your Elastic Agent integrations already send through Logstash, keep that setup by using the Fleet Logstash output. Elastic Agent configured as an OTel Collector includes a Logstash exporter for ECS events produced by Beat receivers, but it doesn't forward OTLP metrics or Prometheus remote write traffic through Logstash, and Logstash has no OTLP or remote write input.
Elastic accepts Prometheus metrics in three ways:
- Prometheus remote write. Recommended when Prometheus already scrapes your targets. Add a
remote_writetarget and keep your scrape configurations unchanged. Any client that sends Prometheus remote write 1.0 works, including Prometheus and Grafana Alloy. Remote write 2.0 is not supported, so configure clients to use 1.0. Metrics keep their Prometheus names and land in a TSDS. - OpenTelemetry Collector. Scrape targets with the
prometheusreceiver in Elastic Agent configured as an OTel Collector, or in another Collector, and export OTLP to the endpoints in Ingest with OpenTelemetry. Use this when you're retiring Prometheus rather than keeping it. The Collector'sprometheusremotewriteexporter also works against the remote write endpoint, but it rewrites metric names with Prometheus suffixes and underscores, and the endpoint drops the native histograms it produces for OpenTelemetry exponential histograms. Use it only when you can't change the exporter. - Elastic Agent Prometheus integration. Scrapes exporters or a Prometheus server's federation endpoint, receives remote write on the agent, or runs PromQL queries against a Prometheus server. It stores ECS documents under
prometheus.*and isn't deprecated. Use it when you need ECS or Fleet management. Refer to the Prometheus integration for setup instructions.
Elasticsearch doesn't implement Prometheus remote read or the federation endpoint, and the Managed OTLP Endpoint and APM Server or managed inputs don't accept remote write.
The remote write endpoint depends on your deployment:
Use the Managed Prometheus Remote Write endpoint. Managed inputs, the endpoints Elastic Cloud runs for you, provide durable buffering, unified authentication, and back-pressure handling before data reaches Elasticsearch. Sending remote write traffic directly to the Elasticsearch endpoint bypasses that.
/_prometheus/api/v1/write endpoint. Managed inputs aren't available on these deployments. For the URL, authentication, Grafana Alloy configuration, and data stream routing, refer to Prometheus remote write endpoint.
For the side-by-side ingest sequence and how to switch over, refer to Migrate from Prometheus.
After metrics are flowing, explore and query them in Kibana. Metrics volume grows quickly, so set up storage and retention before your rollout becomes production-critical.