Indicates whether the agent policy has tamper protection enabled. Defaults to false.
is_verifierboolean
keep_monitoring_alivebooleannullable
When set to true, monitoring will be enabled but logs/metrics collection will be disabled
min_agent_versionstringnullable
monitoring_diagnosticsobject
limitobject
burstnumber
intervalstring
uploaderobject
init_durstring
max_durstring
max_retriesnumber
monitoring_enabledenum[] · max items: 3
Values:logsmetricstraces
monitoring_httpobject
bufferobject
enabledboolean · default: false
enabledboolean
hoststring
portnumber · min: 0 · max: 65353
monitoring_output_idstringnullable
monitoring_pprof_enabledboolean
namestring · min length: 1required
namespacestring · min length: 1required
overridesmapstring to objectnullable
Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
package_agent_version_conditionsobject[] · max items: 1000nullable
namestringrequired
titlestringrequired
version_conditionstringrequired
package_policiesunionanyOf
Any of:
string[]
{}package_policy_response[]
additional_datastreams_permissionsstring[] · max items: 1000nullable
Additional data stream permissions that will be added to the agent policy.
agentsnumber
cloud_connector_idstringnullable
ID of the cloud connector associated with this package policy.
cloud_connector_namestring · min length: 1 · max length: 255nullable
Transient field for cloud connector name during creation.
conditionstring · max length: 10000nullable
Agent condition expression to evaluate whether to apply this integration to its inputs.
created_atstringrequired
created_bystringrequired
descriptionstring
Package policy description
elasticsearchobject
privilegesobject
clusterstring[] · max items: 100
enabledbooleanrequired
global_data_tagsobject[] · max items: 100nullable
namestringrequired
The name of the custom field. Cannot contain spaces.
valuenumber | stringrequired
The value of the custom field.
idstringrequired
Package policy unique identifier.
inputsunionanyOfrequired
Package policy inputs.
Any of:
{}{ compiled_input, enabled, streams, … }[]
compiled_inputobjectrequired
conditionstring · max length: 10000nullable
Agent condition expression to evaluate whether to apply this input.
configmapstring to object
Package variable (see integration documentation for more information)
<string>object
frozenboolean
typestring
valueobjectrequired
deprecatedobject
descriptionstring · max length: 4096required
replaced_bymapstring to string
<string>string · max length: 1024
sincestring · max length: 50
enabledbooleanrequired
idstring
keep_enabledboolean
migrate_fromstring
namestring
policy_templatestring
streamsobject[] · max items: 1000required
compiled_streamobjectrequired
conditionstring · max length: 10000nullable
Agent condition expression to evaluate whether to apply this stream.
configmapstring to object
Package variable (see integration documentation for more information)
<string>object
frozenboolean
typestring
valueobjectrequired
data_streamobjectrequired
datasetstringrequired
elasticsearchobject
dynamic_datasetboolean
dynamic_namespaceboolean
privilegesobject
indicesstring[] · max items: 100
typestring
deprecatedobject
descriptionstring · max length: 4096required
replaced_bymapstring to string
<string>string · max length: 1024
sincestring · max length: 50
enabledbooleanrequired
idstring
keep_enabledboolean
migrate_fromstring
releaseenum
Values:gabetaexperimental
var_group_selectionsmapstring to string
Variable group selections. Maps var_group name to the selected option name within that group.
<string>string · max length: 1024
varsmapstring to object
Package variable (see integration documentation for more information)
<string>object
frozenboolean
typestring
valueobjectrequired
typestringrequired
var_group_selectionsmapstring to string
Variable group selections. Maps var_group name to the selected option name within that group.
<string>string · max length: 1024
varsmapstring to object
Package variable (see integration documentation for more information)
<string>object
frozenboolean
typestring
valueobjectrequired
Package policy inputs. Refer to the integration documentation to know which inputs are available.
<string>object
conditionstring · max length: 10000nullable
Agent condition expression to evaluate whether to apply this input.
deprecatedobject
descriptionstring · max length: 4096required
replaced_bymapstring to string
<string>string · max length: 1024
sincestring · max length: 50
enabledboolean
Enable or disable that input. Defaults to true (enabled).
streamsmapstring to object
Input streams. Refer to the integration documentation to know which streams are available.
<string>object
conditionstring · max length: 10000nullable
Agent condition expression to evaluate whether to apply this stream.
deprecatedobject
descriptionstring · max length: 4096required
replaced_bymapstring to string
<string>string · max length: 1024
sincestring · max length: 50
enabledboolean
Enable or disable that stream. Defaults to true (enabled).
var_group_selectionsmapstring to string
Variable group selections. Maps var_group name to the selected option name within that group.
<string>string · max length: 1024
varsmapstring to anyOf
Input/stream level variable. Refer to the integration documentation for more information.
<string>unionanyOf · default: null
Any of:
string[]
number[]
idstring · max length: 255required
isSecretRefbooleanrequired
varsmapstring to anyOf
Input/stream level variable. Refer to the integration documentation for more information.
<string>unionanyOf · default: null
Any of:
string[]
number[]
idstring · max length: 255required
isSecretRefbooleanrequired
is_managedboolean
namestringrequired
Unique name for the package policy.
namespacestring · max length: 100
The package policy namespace. Leave blank to inherit the agent policy's namespace.
output_idstringnullable
overridesobjectnullable
Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
inputsmapstring to object
packageobject
experimental_data_stream_featuresobject[] · max items: 100
data_streamstring · max length: 1024required
featuresobjectrequired
doc_value_only_numericboolean
doc_value_only_otherboolean
synthetic_sourceboolean
tsdbboolean
fips_compatibleboolean
namestring · max length: 255required
Package name
requires_rootboolean
titlestring · max length: 255
versionstring · max length: 50required
Package version
package_agent_version_conditionstring
policy_idstringnullabledeprecated
ID of the agent policy which the package policy will be added to.
policy_idsstring[] · max items: 1000
revisionnumberrequired
Package policy revision.
secret_referencesobject[] · max items: 1000
idstringrequired
spaceIdsstring[] · max items: 100
supports_agentlessbooleannullable
Indicates whether the package policy belongs to an agentless agent policy.
supports_cloud_connectorbooleannullable
Indicates whether the package policy supports cloud connectors.
updated_atstringrequired
updated_bystringrequired
var_group_selectionsmapstring to string
Variable group selections. Maps var_group name to the selected option name within that group.
<string>string · max length: 1024
varsunionanyOf
Package level variable.
Any of:
Package variable (see integration documentation for more information)
<string>object
frozenboolean
typestring
valueobjectrequired
Input/stream level variable. Refer to the integration documentation for more information.
versionstring
Package policy ES version.
required_versionsobject[] · max items: 100nullable
percentagenumber · min: 0 · max: 100required
Target percentage of agents to auto upgrade
versionstringrequired
Target version for automatic agent upgrade
revisionnumberrequired
schema_versionstring
space_idsstring[] · max items: 100
statusenumrequired
Values:activeinactive
supports_agentlessbooleannullable
Indicates whether the agent policy supports agentless integrations.