System Integration

The System integration allows you to monitor servers, personal computers, and more.

Use the System integration to collect metrics and logs from your machines. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference data when troubleshooting an issue.

For example, if you wanted to be notified when less than 10% of the disk space is still available, you could install the System integration to send file system metrics to Elastic. Then, you could view real-time updates to disk space used on your system in Kibana's [Metrics System] Overview dashboard. You could also set up a new rule in the Elastic Observability Metrics app to alert you when the percent free is less than 10% of the total disk space.

If you're collecting Windows event logs, note that there are three related integrations:

• System integration (this integration): Collects logs from the Windows Application, System, and Security channels with specialized ingest pipelines optimized for observability use cases.
• Windows integration: Collects logs from Windows-specific channels like PowerShell, Sysmon, Windows Defender, and AppLocker with specialized security-focused ingest pipelines. Use this for security monitoring and advanced Windows telemetry.
• Custom Windows event log package: Collects logs from any user-defined Windows event log channel. Use this when you need to collect from channels not covered by the System or Windows integrations. Note that this integration does not include specialized ingest pipelines—you'll need to create custom pipelines if additional processing is required.

The System integration collects two types of data: logs and metrics.

Logs help you keep a record of events that happen on your machine. Log data streams collected by the System integration include application, system, and security events on machines running Windows and auth and syslog events on machines running macOS or Linux. See more details in the Logs reference.

Metrics give you insight into the state of the machine. Metric data streams collected by the System integration include CPU usage, load statistics, memory usage, information on network behavior, and more. See more details in the Metrics reference.

You can enable and disable individual data streams. If all data streams are disabled and the System integration is still enabled, Fleet uses the default data streams.

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

Each data stream collects different kinds of metric data, which may require dedicated permissions to be fetched and which may vary across operating systems. Details on the permissions needed for each data stream are available in the Metrics reference.

To read Journald logs from within a container, you need to use a Docker image variant that contains journalctl binary. The variant supporting Journald is elastic-agent-complete.

Journal files can have breaking changes making it impossible to read files generated by a newer versions of Journald. Ensure the journal files you are reading were generated by a version equal to or older than the journalctl shipped with the Docker image.

To check the version of journalctl shipped with an Elastic-Agent Docker image, run the following command:

docker run --rm -it --entrypoint journalctl docker.elastic.co/elastic-agent/elastic-agent-complete:<VERSION>  --version

For step-by-step instructions on how to set up an integration, see the Getting started guide.

Note that certain data streams may access /proc to gather process information, and the resulting ptrace_may_access() call by the kernel to check for permissions can be blocked by AppArmor and other LSM software, even though the System module doesn't use ptrace directly.

In addition, when running inside a container the proc filesystem directory of the host should be set using system.hostfs setting to /hostfs.

If you specify more than 22 query conditions (event IDs or event ID ranges), some versions of Windows will prevent the integration from reading the event log due to limits in the query system. If this occurs, a similar warning as shown below:

The specified query is invalid.

In some cases, the limit may be lower than 22 conditions. For instance, using a mixture of ranges and single event IDs, along with an additional parameter such as ignore older, results in a limit of 21 conditions.

If you have more than 22 conditions, you can work around this Windows limitation by using a drop_event processor to do the filtering after filebeat has received the events from Windows. The filter shown below is equivalent to event_id: 903, 1024, 2000-2004, 4624 but can be expanded beyond 22 event IDs.

- drop_event.when.not.or:
  - equals.winlog.event_id: "903"
  - equals.winlog.event_id: "1024"
  - equals.winlog.event_id: "4624"
  - range:
      winlog.event_id.gte: 2000
      winlog.event_id.lte: 2004

Starting with version 2.24.0, the New users panels in the [Logs System] New users and groups dashboard read the created account from the ECS fields user.target.name and user.target.id. The integration populates these fields for useradd events starting with version 2.22.0. Events ingested by earlier versions only store the created account in user.name and user.id, so the New users panels don't show them. If the selected time range contains only events from before the upgrade, the panels are empty.

To include the older events, copy the account from user.name and user.id into user.target.name and user.target.id. Backing indices created before the upgrade might not map the user.target.* fields. To make sure the backfilled values are mapped as keyword and the panels can aggregate on them, first add the mapping to all backing indices of the system.auth data stream:

PUT logs-system.auth-*/_mapping
{
  "properties": {
    "user": {
      "properties": {
        "target": {
          "properties": {
            "id": { "type": "keyword", "ignore_above": 1024 },
            "name": {
              "type": "keyword",
              "ignore_above": 1024,
              "fields": { "text": { "type": "match_only_text" } }
            }
          }
        }
      }
    }
  }
}

Then run an update by query request. The request targets the system.auth data stream in every namespace and only changes useradd events that don't have user.target.name set:

POST logs-system.auth-*/_update_by_query?conflicts=proceed
{
  "query": {
    "bool": {
      "filter": [
        { "exists": { "field": "system.auth.useradd.home" } },
        { "exists": { "field": "user.name" } }
      ],
      "must_not": [
        { "exists": { "field": "user.target.name" } }
      ]
    }
  },
  "script": {
    "source": "if (ctx._source.user.target == null) { ctx._source.user.target = new HashMap(); } ctx._source.user.target.name = ctx._source.user.name; if (ctx._source.user.id != null) { ctx._source.user.target.id = ctx._source.user.id; }"
  }
}

The update rewrites every matching document. Read-only backing indices, such as searchable snapshot indices in the cold or frozen tier, can't be updated, and the mapping request fails if a backing index already maps user.target.name with a different type. In both cases, replace logs-system.auth-* in the two requests with an explicit list of the writable backing indices that need the backfill. Use GET _data_stream/logs-system.auth-* to list the backing indices of each data stream. As an alternative, narrow the dashboard time range to events ingested after the upgrade to version 2.22.0.

The Windows application data stream provides events from the Windows Application event log.

• Windows

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The Windows system data stream provides events from the Windows System event log.

• Windows

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The Windows security data stream provides events from the Windows Security event log.

• Windows

{
    "@timestamp": "2019-11-07T10:37:04.226Z",
    "agent": {
        "ephemeral_id": "7b61ba2a-a1b9-4711-87d0-1b3aad5afb85",
        "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.8.0"
    },
    "data_stream": {
        "dataset": "system.security",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d",
        "snapshot": false,
        "version": "8.8.0"
    },
    "event": {
        "action": "logging-service-shutdown",
        "agent_id_status": "verified",
        "category": [
            "process"
        ],
        "code": "1100",
        "created": "2023-07-18T12:31:50.439Z",
        "dataset": "system.security",
        "ingested": "2023-07-18T12:31:51Z",
        "kind": "event",
        "original": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Eventlog' Guid='{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}'/><EventID>1100</EventID><Version>0</Version><Level>4</Level><Task>103</Task><Opcode>0</Opcode><Keywords>0x4020000000000000</Keywords><TimeCreated SystemTime='2019-11-07T10:37:04.226092500Z'/><EventRecordID>14257</EventRecordID><Correlation/><Execution ProcessID='1144' ThreadID='4532'/><Channel>Security</Channel><Computer>WIN-41OB2LO92CR.wlbeat.local</Computer><Security/></System><UserData><ServiceShutdown xmlns='http://manifests.microsoft.com/win/2004/08/windows/eventlog'></ServiceShutdown></UserData></Event>",
        "outcome": "success",
        "provider": "Microsoft-Windows-Eventlog",
        "type": [
            "end"
        ]
    },
    "host": {
        "name": "WIN-41OB2LO92CR.wlbeat.local"
    },
    "input": {
        "type": "httpjson"
    },
    "log": {
        "level": "information"
    },
    "tags": [
        "forwarded",
        "preserve_original_event"
    ],
    "winlog": {
        "channel": "Security",
        "computer_name": "WIN-41OB2LO92CR.wlbeat.local",
        "event_id": "1100",
        "keywords": [
            "Audit Success"
        ],
        "level": "information",
        "opcode": "Info",
        "outcome": "success",
        "process": {
            "pid": 1144,
            "thread": {
                "id": 4532
            }
        },
        "provider_guid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}",
        "provider_name": "Microsoft-Windows-Eventlog",
        "record_id": "14257",
        "time_created": "2019-11-07T10:37:04.226Z"
    }
}

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The auth data stream provides auth logs. It can collect logs from traditional log files (e.g: /var/log/syslog*) or from journald. Both inputs can be enabled at the same time and Conditions can be used to select in which OSes/hosts that input should run.

• macOS prior to 10.8
• Linux

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The syslog data stream provides system logs. It can collect logs from traditional log files (e.g: /var/log/syslog*) or from journald. Both inputs can be enabled at the same time and Conditions can be used to select in which OSes/hosts that input should run.

• macOS
• Linux

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System core data stream provides usage statistics for each CPU core.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System cpu data stream provides CPU statistics.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System diskio data stream provides disk IO metrics collected from the operating system. One event is created for each disk mounted on the system.

• Linux
• macOS (requires 10.10+)
• Windows
• FreeBSD (amd64)

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System filesystem data stream provides file system statistics. For each file system, one document is provided.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System fsstat data stream provides overall file system statistics.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System load data stream provides load statistics.

• FreeBSD
• Linux
• macOS
• OpenBSD

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System memory data stream provides memory statistics.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System network data stream provides network IO metrics collected from the operating system. One event is created for each network interface.

• FreeBSD
• Linux
• macOS
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System ntp data stream provides Network Time Protocol metrics (offsets) collected from the NTP servers. One event is created for NTP server.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

{
    "@timestamp": "2025-08-21T11:37:00.968Z",
    "agent": {
        "ephemeral_id": "821302c1-5eab-4daf-9d96-cd6a592a2899",
        "id": "60f3e256-2915-4811-8dc2-6fb0e6e604f1",
        "name": "elastic-agent-91384",
        "type": "metricbeat",
        "version": "9.2.0"
    },
    "data_stream": {
        "dataset": "system.ntp",
        "namespace": "99647",
        "type": "metrics"
    },
    "ecs": {
        "version": "8.0.0"
    },
    "elastic_agent": {
        "id": "60f3e256-2915-4811-8dc2-6fb0e6e604f1",
        "snapshot": true,
        "version": "9.2.0"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "system.ntp",
        "duration": 56473494,
        "ingested": "2025-08-21T11:37:03Z",
        "module": "system"
    },
    "host": {
        "architecture": "aarch64",
        "containerized": false,
        "hostname": "elastic-agent-91384",
        "ip": [
            "172.20.0.4",
            "172.21.0.2"
        ],
        "mac": [
            "02-42-AC-14-00-04",
            "02-42-AC-15-00-02"
        ],
        "name": "elastic-agent-91384",
        "os": {
            "family": "",
            "kernel": "6.8.0-50-generic",
            "name": "Wolfi",
            "platform": "wolfi",
            "type": "linux",
            "version": "20230201"
        }
    },
    "metricset": {
        "name": "ntp",
        "period": 10000
    },
    "service": {
        "type": "system"
    },
    "system": {
        "ntp": {
            "host": "pool.ntp.org",
            "offset": 5858029
        }
    }
}

The System process data stream provides process statistics. One document is provided for each process. Refer to the Configuration section for more details on how to change the process configuration.

• FreeBSD
• Linux
• macOS
• Windows

Process execution data should be available for an authorized user. If running as less privileged user, it may not be able to read process data belonging to other users.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The process_summary data stream collects high level statistics about the running processes.

• FreeBSD
• Linux
• macOS
• Windows

General process summary data should be available without elevated permissions. If the process data belongs to the other users, it will be counted as unknown value.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System socket_summary data stream provides the summary of open network sockets in the host system.

It collects a summary of metrics with the count of existing TCP and UDP connections and the count of listening ports.

• FreeBSD
• Linux
• macOS
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

The System uptime data stream provides the uptime of the host operating system.

• Linux
• macOS
• OpenBSD
• FreeBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Alert rule templates provide pre-defined configurations for creating alert rules in Kibana.

For more information, refer to the Elastic documentation.

Alert rule templates require Elastic Stack version 9.2.0 or later.

The following alert rule templates are available:

[System] CPU Utilization

[System] Disk I/O Saturation

[System] High Disk I/O Latency

[System] High Network Error Rate

[System] High Packet Drop Rate

[System] Memory Utilization

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.