spec.yaml

name: Elasticsearch
fleet_configurable: true
files:
- name: elastic.yaml
  options:
  - template: init_config
    options:
    - template: init_config/http
    - template: init_config/default
  - template: instances
    options:
    - name: url
      fleet_configurable: true
      required: true
      description: |
        The URL where Elasticsearch accepts HTTP requests. This is used to
        fetch statistics from the nodes and information about the cluster health.
      formats: ["url"]
      value:
        example: http://localhost:9200
        type: string
    - name: node_name_as_host
      description: |
        If each machine only runs a single Elasticsearch node per cluster, you
        want to set each Elasticsearch `node.name` to the machine hostname. You may
        then set `node_name_as_host` to `true` to avoid duplicate hostnames.
        See: https://www.elastic.co/guide/en/elasticsearch/reference/current/node.name.html
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: cluster_stats
      description: |
        If your cluster is hosted externally (i.e., you're not pointing to localhost),
        you must set `cluster_stats` to true, otherwise the check only
        submits metrics of the local node.
        This parameter was also called `is_external` and you can still use it but it
        is removed in Agent version 6+.
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: detailed_index_stats
      description: |
        If you want to obtain index-specific stats, use this flag with `cluster_stats` and `pshard_stats` set to true.
        Without this flag you only get stats from `_all`.
        Do not use it if you are pointing to localhost.
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: index_stats
      description: Set `index_stats` to true to collect metrics for individual indices.
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: pshard_stats
      description: |
        If you enable the `pshard_stats` flag, statistics over primary shards
        are collected by the check and sent to the backend with the
        `elasticsearch.primary` prefix. It is particularly useful if you want to
        get certain metrics without taking replicas into account. For instance,
        `elasticsearch.primaries.docs.count` gives you the total number of
        documents in your indexes WITHOUT counting duplicates due to the existence
        of replica shards in your ES cluster.
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: slm_stats
      description: |
        Set `slm_stats` to true to collect statistics about Snapshot Lifecycle Management.
        The user must have the `read_slm` cluster privilege to get these metrics.
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: pshard_graceful_timeout
      description: Continue gracefully if pshard stats timeout.
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: pending_task_stats
      description: |
        Specifies whether to collect data exposed by the `pending_tasks` cluster endpoint.
        Ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/cluster-pending.html
        Some managed Elasticsearch services (e.g., AWS Elasticsearch) do not expose this endpoint.
        Set `pending_task_stats` to false if you use such a service.
      fleet_configurable: true
      value:
        type: boolean
        example: true
    - name: cat_allocation_stats
      description: |
        Enable to collect Elastic Cat Allocation metrics. Available only for Elasticsearch 5.0 or higher.
        Ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-allocation.html.
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: admin_forwarder
      description: |
        Specifies a URL that includes a context root
        needed for a forwarder application to access Elasticsearch REST services, for example:
        https://www.ibm.com/support/knowledgecenter/SSFTN5_8.5.6/com.ibm.wbpm.main.doc/topics/tadm_fps_esearch.html
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: gc_collectors_as_rate
      description: |
        Submit `jvm.gc.collectors` metrics as rate.
        Note: Only for ES versions 0.9.10 or higher.
      fleet_configurable: true
      value:
        type: boolean
        example: false
    - name: disable_legacy_cluster_tag
      description: Enable to stop submitting the tag `cluster_name`, which has been renamed to `elastic_cluster`.
      fleet_configurable: true
      value:
        type: boolean
        display_default: false
        example: true
      enabled: false
    - name: disable_legacy_service_check_tags
      description: |
        Disable the submission of the Elasticsearch `host` and `port` as tags in service checks.
        Submit them as `url` instead.
      fleet_configurable: true
      value:
        type: boolean
        display_default: false
        example: true
      enabled: true
    - name: custom_queries
      description: |
        Run custom queries for Elasticsearch. Each custom query endpoint can collect multiple metrics and tags.
        Note: Each custom query requires an `endpoint`, `data_path`, and `columns` parameter. Each `columns` parameter
        should have at least one value containing `name` and `value_path`.

        Each query can have the following parameters:

        1. endpoint - The Elasticsearch API endpoint to query.

        2. data_path - The JSON path up to, but not including, the metric. For example, if querying for size of parent
                       circuit breaker, the full path is 'breakers.parent.estimated_size_in_bytes', which means the
                       `data_path` is 'breakers.parent'. `data_path` cannot contain any wildcards, so accessing data
                       indexed by ID (such as node or index) is not possible.

        3. columns - The list representing the data to be collected from the JSON query. There are two required pieces
                     of data:
              1. value_path - This is the JSON path from the `data_path` to the metric. This path may include string
                              keys as well as list indices. For example, if querying for size of parent circuit
                              breaker, the `value_path` is `estimated_size_in_bytes`.
              2. name - The full metric name sent to Datadog. If `type` is `tag`, this column is considered a tag and
                        applied to every metric collected by this particular query.
              3. type (optional) - An optional parameter to designate the type of data sent. Possible values for
                                   `type` include `gauge`, `monotonic_count`, `rate`, and `tag`, with `gauge` being
                                   the default.

        4. payload (optional) - An optional payload can be included when querying the endpoint. This turns the GET
                                request into a POST request, so a read-only user should be used when writing
                                custom queries with a payload. Use YAML formatting when including a payload.

      fleet_configurable: true
      value:
        example:
        - endpoint: /_search
          data_path: aggregations.genres.buckets
          payload:
            aggs:
              genres:
                terms:
                  field: "id"
          columns:
          - value_path: key
            name: id
            type: tag
          - value_path: doc_count
            name: elasticsearch.doc_count
          tags:
          - custom_tag:1
        type: array
        items:
          type: object
          properties:
            - name: endpoint
              type: string
            - name: data_path
              type: string
            - name: payload
              type: object
            - name: columns
              type: array
              items:
                type: object
                properties:
                  - name: value_path
                    type: string
                  - name: name
                    type: string
                  - name: type
                    type: string
            - name: tags
              type: array
              items:
                type: string
    - name: submit_events
      description: |
        By default we submit events to Datadog if the cluster starts unhealthy or anytime its health changes.
        You can set this option to `false` to disable submitting the events in case you already implemented
        your own custom alerts based on metrics.
      fleet_configurable: true
      value:
        type: boolean
        example: true
    - template: instances/default
    - template: instances/http
  - template: logs
    example:
    - type: file
      path: /var/log/elasticsearch/*.log
      source: elasticsearch
    - type: file
      path: /var/log/elasticsearch/<CLUSTER_NAME>_index_indexing_slowlog.log
      source: elasticsearch
    - type: file
      path: /var/log/elasticsearch/<CLUSTER_NAME>_index_search_slowlog.log
      source: elasticsearch

- name: auto_conf.yaml
  options:
  - template: ad_identifiers
    overrides:
      value.example:
      - elasticsearch
      - elasticsearch-oss
  - template: init_config
    options: []
  - template: instances
    options:
    - name: url
      required: true
      description: |
        The URL where Elasticsearch accepts HTTP requests. This is used to
        fetch statistics from the nodes and information about the cluster health.
      value:
        example: http://%%host%%:9200
        type: string