{
  "name": "linux",
  "title": "Linux Metrics",
  "version": "0.7.2",
  "release": "beta",
  "description": "Collect metrics from Linux servers with Elastic Agent.",
  "type": "integration",
  "download": "/epr/linux/linux-0.7.2.zip",
  "path": "/package/linux/0.7.2",
  "conditions": {
    "kibana": {
      "version": "^8.17.0 || ^9.0.0"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/elastic-agent-data-plane"
  },
  "categories": [
    "os_system"
  ],
  "signature_path": "/epr/linux/linux-0.7.2.zip.sig",
  "format_version": "3.3.0",
  "readme": "/package/linux/0.7.2/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/metricbeat-services-host.png",
      "path": "/package/linux/0.7.2/img/metricbeat-services-host.png",
      "title": "metricbeat services host",
      "size": "5006x2260",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/linux/0.7.2/LICENSE.txt",
    "/package/linux/0.7.2/changelog.yml",
    "/package/linux/0.7.2/manifest.yml",
    "/package/linux/0.7.2/docs/README.md",
    "/package/linux/0.7.2/img/metricbeat-services-host.png",
    "/package/linux/0.7.2/data_stream/conntrack/manifest.yml",
    "/package/linux/0.7.2/data_stream/entropy/manifest.yml",
    "/package/linux/0.7.2/data_stream/iostat/manifest.yml",
    "/package/linux/0.7.2/data_stream/ksm/manifest.yml",
    "/package/linux/0.7.2/data_stream/memory/manifest.yml",
    "/package/linux/0.7.2/data_stream/network_summary/manifest.yml",
    "/package/linux/0.7.2/data_stream/pageinfo/manifest.yml",
    "/package/linux/0.7.2/data_stream/raid/manifest.yml",
    "/package/linux/0.7.2/data_stream/service/manifest.yml",
    "/package/linux/0.7.2/data_stream/socket/manifest.yml",
    "/package/linux/0.7.2/data_stream/users/manifest.yml",
    "/package/linux/0.7.2/kibana/dashboard/linux-system-c431f410-f9ac-11e9-90e8-1fb18e796788.json",
    "/package/linux/0.7.2/data_stream/conntrack/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/conntrack/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/conntrack/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/conntrack/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/entropy/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/entropy/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/entropy/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/entropy/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/iostat/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/iostat/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/iostat/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/iostat/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/ksm/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/ksm/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/ksm/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/ksm/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/memory/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/memory/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/memory/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/memory/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/network_summary/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/network_summary/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/network_summary/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/network_summary/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/pageinfo/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/pageinfo/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/pageinfo/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/pageinfo/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/raid/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/raid/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/raid/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/raid/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/service/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/service/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/service/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/service/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/socket/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/socket/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/socket/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/socket/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/users/fields/agent.yml",
    "/package/linux/0.7.2/data_stream/users/fields/base-fields.yml",
    "/package/linux/0.7.2/data_stream/users/fields/ecs.yml",
    "/package/linux/0.7.2/data_stream/users/fields/fields.yml",
    "/package/linux/0.7.2/data_stream/conntrack/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/entropy/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/iostat/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/ksm/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/memory/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/network_summary/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/pageinfo/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/raid/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/service/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/socket/agent/stream/stream.yml.hbs",
    "/package/linux/0.7.2/data_stream/users/agent/stream/stream.yml.hbs"
  ],
  "policy_templates": [
    {
      "name": "system",
      "title": "Linux kernel metrics",
      "description": "Collect system metrics from Linux operating systems",
      "inputs": [
        {
          "type": "system/metrics",
          "vars": [
            {
              "name": "system.hostfs",
              "type": "text",
              "title": "Proc Filesystem Directory",
              "description": "The proc filesystem base directory.",
              "multi": false,
              "required": false,
              "show_user": true
            }
          ],
          "title": "Collect system metrics from Linux instances",
          "description": "Collecting Linux entropy, Network Summary, RAID, service, socket, and users metrics"
        },
        {
          "type": "linux/metrics",
          "title": "Collect low-level system metrics from Linux instances",
          "description": "Collecting Linux conntrack, ksm, pageinfo metrics."
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "metrics",
      "dataset": "linux.conntrack",
      "title": "System conntrack metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "linux/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host conntrack metrics",
          "description": "Collect network metrics from /proc/net/nf_conntrack",
          "enabled": false,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "conntrack"
    },
    {
      "type": "metrics",
      "dataset": "linux.entropy",
      "title": "System entropy metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "system/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host entropy metrics",
          "description": "Collect Linux entropy metrics",
          "enabled": false,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "entropy"
    },
    {
      "type": "metrics",
      "dataset": "linux.iostat",
      "title": "Linux disk iostat metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "linux/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux iostat metrics",
          "description": "Linux disk stat metrics",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "iostat"
    },
    {
      "type": "metrics",
      "dataset": "linux.ksm",
      "title": "Kernel Samepage merging metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "linux/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host KSM metrics",
          "description": "Collect kernel samepage merging metrics",
          "enabled": false,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "ksm"
    },
    {
      "type": "metrics",
      "dataset": "linux.memory",
      "title": "Linux-only memory metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "linux/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux memory metrics",
          "description": "Linux paging and memory management metrics",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "memory"
    },
    {
      "type": "metrics",
      "dataset": "linux.network_summary",
      "title": "System network_summary metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "system/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host network summary metrics",
          "description": "Collect Linux network_summary metrics",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "network_summary"
    },
    {
      "type": "metrics",
      "dataset": "linux.pageinfo",
      "title": "System page info metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "linux/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host pageinfo metrics",
          "description": "Collect paging statistics as found in /proc/pagetypeinfo",
          "enabled": false,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "pageinfo"
    },
    {
      "type": "metrics",
      "dataset": "linux.raid",
      "title": "System raid metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "system/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "raid.mount_point",
              "type": "text",
              "title": "Raid Mount Point",
              "description": "Specifty a RAID mount location. By default, Any available RAID mounts will be selected.\n",
              "multi": false,
              "required": false,
              "show_user": true
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host raid metrics",
          "description": "Collect Linux raid metrics",
          "enabled": false,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "raid"
    },
    {
      "type": "metrics",
      "dataset": "linux.service",
      "title": "System service metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "system/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "service.state_filter",
              "type": "text",
              "title": "State Filter",
              "description": "Filter systemd services by status or sub-status\n",
              "multi": true,
              "required": false,
              "show_user": true,
              "default": [
                "active"
              ]
            },
            {
              "name": "service.pattern_filter",
              "type": "text",
              "title": "Pattern Filter",
              "description": "Filter systemd services based on a name pattern\n",
              "multi": true,
              "required": false,
              "show_user": true
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host service metrics",
          "description": "Collect Linux service metrics",
          "enabled": false,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "service"
    },
    {
      "type": "metrics",
      "dataset": "linux.socket",
      "title": "System socket metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "system/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "socket.reverse_lookup.enabled",
              "type": "bool",
              "title": "Enable Reverse Lookup",
              "description": "Configure reverse DNS lookup on remote IP addresses in the socket dataset.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": false
            },
            {
              "name": "socket.reverse_lookup.success_ttl",
              "type": "text",
              "title": "Reverse Lookup Success TTL",
              "description": "Success TTL for reverse DNS lookup on remote IP addresses in the socket dataset (sample: 10s)",
              "multi": false,
              "required": false,
              "show_user": true
            },
            {
              "name": "socket.reverse_lookup.failure_ttl",
              "type": "text",
              "title": "Reverse Lookup Failure TTL",
              "description": "Failure TTL for reverse DNS lookup on remote IP addresses in the socket dataset (sample: 10s)",
              "multi": false,
              "required": false,
              "show_user": true
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host socket metrics",
          "description": "Collect Linux socket metrics",
          "enabled": false,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "socket"
    },
    {
      "type": "metrics",
      "dataset": "linux.users",
      "title": "System users metrics",
      "release": "experimental",
      "streams": [
        {
          "input": "system/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10s"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the metrics are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Linux host user metrics",
          "description": "Collect Linux users metrics",
          "enabled": false,
          "ingestion_method": "File"
        }
      ],
      "package": "linux",
      "path": "users"
    }
  ]
}