kibana/docs/management/managing-beats.asciidoc

[[managing-beats]]
[role="xpack"]
== {beats} Central Management

include::{asciidoc-dir}/../../shared/discontinued.asciidoc[tag=cm-discontinued]

Use the Central Management UI under *Management > {beats}* to define and
manage configurations in a central location in {kib} and quickly deploy
configuration changes to all {beats} running across your enterprise. For more
about central management, see the related {beats} documentation:

* {filebeat-ref}/configuration-central-management.html[{filebeat} documentation]
* {metricbeat-ref}/configuration-central-management.html[{metricbeat} documentation]

[NOTE]
====
This feature requires an Elastic license that includes {beats} central
management.

Don't have a license? You can start a 30-day trial. In {kib}, go to
*Management > License Management*. At the end of the trial
period, you can purchase a subscription to keep using central management. For
more information, see https://www.elastic.co/subscriptions and
{stack-ov}/license-management.html[License Management].
====

{kib} makes it easy for you to use central management by walking you through the
enrollment and configuration process step by step the first time you use the
Central Management UI.


[float]
=== Enroll {beats}

You need to enroll {beats} to register them in central management and establish
trust. Enrolled {beats} will have the credentials needed to retrieve
configurations from {kib}.

[float]
=== Create configuration tags

A _configuration tag_ is a group of configuration blocks that you can apply to
one or more {beats}. For example, you can create a tag called `development` to
group configurations for {beats} running in your development environment.

The first time you walk through the enrollment process, you'll create a
configuration tag that's applied to the {beats} instance you're enrolling.

After that, under *Configuration tags*, you can create additional tags and
apply them to any enrolled {beats}, and the {beats} will use the configurations
defined in the tag.

[float]
=== Add configuration blocks

Add one or more configuration blocks to the tag. A tag can have configuration
blocks for different types of {beats}. When the enrolled {beats} run, they will
use the configuration blocks that are valid for their type.

Central management supports configuration settings for:

* {filebeat} modules
* {metricbeat} modules
* {filebeat} inputs
* {filebeat} and {metricbeat} outputs

NOTE: Central management supports the following outputs only: {es}, {ls}, Kafka,
and Redis. Other output types are not supported for {beats} that are enrolled in
central management.

Use the Central Management UI to define and manage settings for supported
configuration blocks. You cannot define those settings in local {beats}
configuration files. For configuration blocks that are not supported by central
management, configure the settings in the local configuration file after
enrolling the Beat in central management.

[float]
=== Manage enrolled {beats}

Under *Enrolled {beats}*, you can view the list of enrolled {beats} to see
details, including the type, applied tags, configuration status, and the last
configuration update. Click the *Beat name* or *Type* column heading to sort the
list. To filter the list, enter a search string. If there are errors in a
configuration, you’ll see an Error status in the Central Management UI and need
to look at {beats} logs to troubleshoot the problem.

You can add or remove tags, and the configuration changes are automatically
deployed to all {beats} that have the tag. Avoid applying tags with conflicting
configurations. Because the configurations for all assigned tags are merged,
conflicting configurations result in errors.

You can unenroll {beats} to remove them from central management.

[float]
=== Manage tags

Under *Configuration tags*, you can select tags and delete them, or you can
drill down into a tag to add, modify, or remove configuration blocks from the
tag. When you change the configuration blocks or remove tags, the configuration
changes are automatically deployed to all {beats} that have the tag.