You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
ess-leadin: "You can run Elasticsearch on your own hardware or use our hosted Elasticsearch Service that is available on AWS, GCP, and Azure. https://cloud.elastic.co/registration{ess-utm-params}[Try the Elasticsearch Service for free]."
227
94
ess-leadin-short: "Our hosted Elasticsearch Service is available on AWS, GCP, and Azure, and you can https://cloud.elastic.co/registration{ess-utm-params}[try it for free]."
228
95
ess-icon: "image:https://doc-icons.s3.us-east-2.amazonaws.com/logo_cloud.svg[link=\"https://cloud.elastic.co/registration{ess-utm-params}\", title=\"Supported on Elasticsearch Service\"]"
Copy file name to clipboardExpand all lines: reference/ingestion-tools/fleet/data-streams-scenario1.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -73,7 +73,7 @@ To confirm that the index template is using the `logs@custom` component template
73
73
2. Search for `logs@` and select the `logs@custom` component template.
74
74
3. The **Summary** shows the list of all data streams that use the component template, and the **Settings** view shows your newly configured ILM policy.
75
75
76
-
New ILM policies only take effect when new indices are created, so you either must wait for a rollover to occur (usually after 30 days or when the index size reaches 50 GB), or force a rollover of each data stream using the {{ref}}/indices-rollover-index.html[{{es}} rollover API.
76
+
New ILM policies only take effect when new indices are created, so you either must wait for a rollover to occur (usually after 30 days or when the index size reaches 50 GB), or force a rollover of each data stream using the {{es}} [rollover API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-rollover).
Copy file name to clipboardExpand all lines: reference/ingestion-tools/fleet/data-streams-scenario2.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -69,7 +69,7 @@ To confirm that the index template is using the `logs@custom` component template
69
69
2. Search for `system` and select the `logs-system.auth@custom` component template.
70
70
3. The **Summary** shows the list of all data streams that use the component template, and the **Settings** view shows your newly configured ILM policy.
71
71
72
-
New ILM policies only take effect when new indices are created, so you either must wait for a rollover to occur (usually after 30 days or when the index size reaches 50 GB), or force a rollover of the data stream using the {{ref}}/indices-rollover-index.html[{{es}} rollover API:
72
+
New ILM policies only take effect when new indices are created, so you either must wait for a rollover to occur (usually after 30 days or when the index size reaches 50 GB), or force a rollover of the data stream using the {{es}} [rollover API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-rollover):
Copy file name to clipboardExpand all lines: reference/ingestion-tools/fleet/migrate-auditbeat-to-agent.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -32,7 +32,7 @@ The following table describes the integrations you can use instead of {{auditbea
32
32
|[System.package](asciidocalypse://docs/beats/docs/reference/auditbeat/auditbeat-dataset-system-package.md) dataset |[System Audit](asciidocalypse://docs/integration-docs/docs/reference/system_audit.md) integration | This integration is a direct replacement of the System Package dataset. Starting in {{stack}} 8.7, you can port rules and configuration settings to this integration. This integration currently schedules collection of information such as:<br><br>*[rpm_packages](https://www.osquery.io/schema/5.1.0/#rpm_packages)<br>*[deb_packages](https://www.osquery.io/schema/5.1.0/#deb_packages)<br>*[homebrew_packages](https://www.osquery.io/schema/5.1.0/#homebrew_packages)<br> |
33
33
|[Osquery](asciidocalypse://docs/integration-docs/docs/reference/osquery.md) or [Osquery Manager](asciidocalypse://docs/integration-docs/docs/reference/osquery_manager.md) integration | Schedule collection of information like:<br><br>*[rpm_packages](https://www.osquery.io/schema/5.1.0/#rpm_packages)<br>*[deb_packages](https://www.osquery.io/schema/5.1.0/#deb_packages)<br>*[homebrew_packages](https://www.osquery.io/schema/5.1.0/#homebrew_packages)<br>*[apps](https://www.osquery.io/schema/5.1.0/#apps) (MacOS)<br>*[programs](https://www.osquery.io/schema/5.1.0/#programs) (Windows)<br>*[npm_packages](https://www.osquery.io/schema/5.1.0/#npm_packages)<br>*[atom_packages](https://www.osquery.io/schema/5.1.0/#atom_packages)<br>*[chocolatey_packages](https://www.osquery.io/schema/5.1.0/#chocolatey_packages)<br>*[portage_packages](https://www.osquery.io/schema/5.1.0/#portage_packages)<br>*[python_packages](https://www.osquery.io/schema/5.1.0/#python_packages)<br> |
34
34
|[System.process](asciidocalypse://docs/beats/docs/reference/auditbeat/auditbeat-dataset-system-process.md) dataset |[Endpoint](/solutions/security/configure-elastic-defend/install-elastic-defend.md)| Best replacement because out of the box it reports events forevery process in [ECS](asciidocalypse://docs/integration-docs/docs/reference/index.md) format and has excellentintegration in [Kibana](/get-started/the-stack.md). |
35
-
|[Custom Windows event log](asciidocalypse://docs/integration-docs/docs/reference/winlog.md) and{{integrations-docs}}/windows#sysmonoperational[Sysmon] integrations | Provide process data. |
35
+
|[Custom Windows event log](asciidocalypse://docs/integration-docs/docs/reference/winlog.md) and[Sysmon](asciidocalypse://docs/integration-docs/docs/reference/sysmon_linux.md) integrations | Provide process data. |
36
36
|[Osquery](asciidocalypse://docs/integration-docs/docs/reference/osquery.md) or[Osquery Manager](asciidocalypse://docs/integration-docs/docs/reference/osquery_manager.md) integration | Collect data from the [process](https://www.osquery.io/schema/5.1.0/#process) table on some OSeswithout polling. |
37
37
|[System.socket](asciidocalypse://docs/beats/docs/reference/auditbeat/auditbeat-dataset-system-socket.md) dataset |[Endpoint](/solutions/security/configure-elastic-defend/install-elastic-defend.md)| Best replacement because it supports monitoring network connections on Linux,Windows, and MacOS. Includes process and user metadata. Currently does notdo flow accounting (byte and packet counts) or domain name enrichment (but doescollect DNS queries separately). |
38
38
|[Osquery](asciidocalypse://docs/integration-docs/docs/reference/osquery.md) or [Osquery Manager](asciidocalypse://docs/integration-docs/docs/reference/osquery_manager.md) integration | Monitor socket events via the [socket_events](https://www.osquery.io/schema/5.1.0/#socket_events) tablefor Linux and MacOS. |
0 commit comments