Configuring data streams created by Elastic Agentedit

When monitoring using Elastic Agent, data is stored in a set of data streams named metrics-{product}.stack_monitoring.{dataset}-{namespace}. For example: metrics-elasticsearch.stack_monitoring.shard-default.

The settings and mappings for these data streams are determined by an index template named metrics-{product}.stack_monitoring.{dataset}. For example: metrics-elasticsearch.stack_monitoring.shard.

To change the settings of each data stream, edit the metrics-{product}.stack_monitoring.{dataset}@custom component template that already exists. You can do this in Kibana:

  • Navigate to Stack Management > Index Management > Component Templates.
  • Search for the component template.
  • Select the Edit action.

You can also use the Elasticsearch API:

After changing the component template, the updated settings are only applied to the data stream’s new backing indices. Roll over the data stream to immediately apply the updated settings to the data stream’s write index.