The System integration allows you to monitor servers, personal computers, and more.

Use the System integration to collect metrics and logs from your machines. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference data when troubleshooting an issue.

For example, if you wanted to be notified when less than 10% of the disk space is still available, you could install the System integration to send file system metrics to Elastic. Then, you could view real-time updates to disk space used on your system in Kibana's [Metrics System] Overview dashboard. You could also set up a new rule in the Elastic Observability Metrics app to alert you when the percent free is less than 10% of the total disk space.

If you're collecting Windows event logs, note that there are three related integrations:

• System integration (this integration): Collects logs from the Windows Application, System, and Security channels with specialized ingest pipelines optimized for observability use cases.
• Windows integration: Collects logs from Windows-specific channels like PowerShell, Sysmon, Windows Defender, and AppLocker with specialized security-focused ingest pipelines. Use this for security monitoring and advanced Windows telemetry.
• Custom Windows event log package: Collects logs from any user-defined Windows event log channel. Use this when you need to collect from channels not covered by the System or Windows integrations. Note that this integration does not include specialized ingest pipelines—you'll need to create custom pipelines if additional processing is required.

The System integration collects two types of data: logs and metrics.

Logs help you keep a record of events that happen on your machine. Log data streams collected by the System integration include application, system, and security events on machines running Windows and auth and syslog events on machines running macOS or Linux. See more details in the Logs reference.

Metrics give you insight into the state of the machine. Metric data streams collected by the System integration include CPU usage, load statistics, memory usage, information on network behavior, and more. See more details in the Metrics reference.

You can enable and disable individual data streams. If all data streams are disabled and the System integration is still enabled, Fleet uses the default data streams.

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.

Each data stream collects different kinds of metric data, which may require dedicated permissions to be fetched and which may vary across operating systems. Details on the permissions needed for each data stream are available in the Metrics reference.

To read Journald logs from within a container, you need to use a Docker image variant that contains journalctl binary. The variant supporting Journald is elastic-agent-complete.

Journal files can have breaking changes making it impossible to read files generated by a newer versions of Journald. Ensure the journal files you are reading were generated by a version equal to or older than the journalctl shipped with the Docker image.

To check the version of journalctl shipped with an Elastic-Agent Docker image, run the following command:

docker run --rm -it --entrypoint journalctl docker.elastic.co/elastic-agent/elastic-agent-complete:<VERSION>  --version

For step-by-step instructions on how to set up an integration, see the Getting started guide.

Note that certain data streams may access /proc to gather process information, and the resulting ptrace_may_access() call by the kernel to check for permissions can be blocked by AppArmor and other LSM software, even though the System module doesn't use ptrace directly.

In addition, when running inside a container the proc filesystem directory of the host should be set using system.hostfs setting to /hostfs.

If you specify more than 22 query conditions (event IDs or event ID ranges), some versions of Windows will prevent the integration from reading the event log due to limits in the query system. If this occurs, a similar warning as shown below:

The specified query is invalid.

In some cases, the limit may be lower than 22 conditions. For instance, using a mixture of ranges and single event IDs, along with an additional parameter such as ignore older, results in a limit of 21 conditions.

If you have more than 22 conditions, you can work around this Windows limitation by using a drop_event processor to do the filtering after filebeat has received the events from Windows. The filter shown below is equivalent to event_id: 903, 1024, 2000-2004, 4624 but can be expanded beyond 22 event IDs.

- drop_event.when.not.or:
  - equals.winlog.event_id: "903"
  - equals.winlog.event_id: "1024"
  - equals.winlog.event_id: "4624"
  - range:
      winlog.event_id.gte: 2000
      winlog.event_id.lte: 2004

The Windows application data stream provides events from the Windows Application event log.

• Windows

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The Windows system data stream provides events from the Windows System event log.

• Windows

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The Windows security data stream provides events from the Windows Security event log.

• Windows

An example event for security looks as following:

{
    "@timestamp": "2019-11-07T10:37:04.226Z",
    "agent": {
        "ephemeral_id": "7b61ba2a-a1b9-4711-87d0-1b3aad5afb85",
        "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.8.0"
    },
    "data_stream": {
        "dataset": "system.security",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d",
        "snapshot": false,
        "version": "8.8.0"
    },
    "event": {
        "action": "logging-service-shutdown",
        "agent_id_status": "verified",
        "category": [
            "process"
        ],
        "code": "1100",
        "created": "2023-07-18T12:31:50.439Z",
        "dataset": "system.security",
        "ingested": "2023-07-18T12:31:51Z",
        "kind": "event",
        "original": "<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Eventlog' Guid='{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}'/><EventID>1100</EventID><Version>0</Version><Level>4</Level><Task>103</Task><Opcode>0</Opcode><Keywords>0x4020000000000000</Keywords><TimeCreated SystemTime='2019-11-07T10:37:04.226092500Z'/><EventRecordID>14257</EventRecordID><Correlation/><Execution ProcessID='1144' ThreadID='4532'/><Channel>Security</Channel><Computer>WIN-41OB2LO92CR.wlbeat.local</Computer><Security/></System><UserData><ServiceShutdown xmlns='http://manifests.microsoft.com/win/2004/08/windows/eventlog'></ServiceShutdown></UserData></Event>",
        "outcome": "success",
        "provider": "Microsoft-Windows-Eventlog",
        "type": [
            "end"
        ]
    },
    "host": {
        "name": "WIN-41OB2LO92CR.wlbeat.local"
    },
    "input": {
        "type": "httpjson"
    },
    "log": {
        "level": "information"
    },
    "tags": [
        "forwarded",
        "preserve_original_event"
    ],
    "winlog": {
        "channel": "Security",
        "computer_name": "WIN-41OB2LO92CR.wlbeat.local",
        "event_id": "1100",
        "keywords": [
            "Audit Success"
        ],
        "level": "information",
        "opcode": "Info",
        "outcome": "success",
        "process": {
            "pid": 1144,
            "thread": {
                "id": 4532
            }
        },
        "provider_guid": "{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}",
        "provider_name": "Microsoft-Windows-Eventlog",
        "record_id": "14257",
        "time_created": "2019-11-07T10:37:04.226Z"
    }
}

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The auth data stream provides auth logs. It can collect logs from traditional log files (e.g: /var/log/syslog*) or from journald. Both inputs can be enabled at the same time and Conditions can be used to select in which OSes/hosts that input should run.

• macOS prior to 10.8
• Linux

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The syslog data stream provides system logs. It can collect logs from traditional log files (e.g: /var/log/syslog*) or from journald. Both inputs can be enabled at the same time and Conditions can be used to select in which OSes/hosts that input should run.

• macOS
• Linux

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System core data stream provides usage statistics for each CPU core.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System cpu data stream provides CPU statistics.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System diskio data stream provides disk IO metrics collected from the operating system. One event is created for each disk mounted on the system.

Note: For retrieving Linux-specific disk I/O metrics, use the Linux integration.

• Linux
• macOS (requires 10.10+)
• Windows
• FreeBSD (amd64)

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System filesystem data stream provides file system statistics. For each file system, one document is provided.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System fsstat data stream provides overall file system statistics.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System load data stream provides load statistics.

• FreeBSD
• Linux
• macOS
• OpenBSD

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System memory data stream provides memory statistics.

Note: For retrieving Linux-specific memory metrics, use the Linux integration.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System network data stream provides network IO metrics collected from the operating system. One event is created for each network interface.

• FreeBSD
• Linux
• macOS
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System ntp data stream provides Network Time Protocol metrics (offsets) collected from the NTP servers. One event is created for NTP server.

• FreeBSD
• Linux
• macOS
• OpenBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

An example event for ntp looks as following:

{
    "@timestamp": "2025-08-21T11:37:00.968Z",
    "agent": {
        "ephemeral_id": "821302c1-5eab-4daf-9d96-cd6a592a2899",
        "id": "60f3e256-2915-4811-8dc2-6fb0e6e604f1",
        "name": "elastic-agent-91384",
        "type": "metricbeat",
        "version": "9.2.0"
    },
    "data_stream": {
        "dataset": "system.ntp",
        "namespace": "99647",
        "type": "metrics"
    },
    "ecs": {
        "version": "8.0.0"
    },
    "elastic_agent": {
        "id": "60f3e256-2915-4811-8dc2-6fb0e6e604f1",
        "snapshot": true,
        "version": "9.2.0"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "system.ntp",
        "duration": 56473494,
        "ingested": "2025-08-21T11:37:03Z",
        "module": "system"
    },
    "host": {
        "architecture": "aarch64",
        "containerized": false,
        "hostname": "elastic-agent-91384",
        "ip": [
            "172.20.0.4",
            "172.21.0.2"
        ],
        "mac": [
            "02-42-AC-14-00-04",
            "02-42-AC-15-00-02"
        ],
        "name": "elastic-agent-91384",
        "os": {
            "family": "",
            "kernel": "6.8.0-50-generic",
            "name": "Wolfi",
            "platform": "wolfi",
            "type": "linux",
            "version": "20230201"
        }
    },
    "metricset": {
        "name": "ntp",
        "period": 10000
    },
    "service": {
        "type": "system"
    },
    "system": {
        "ntp": {
            "host": "pool.ntp.org",
            "offset": 5858029
        }
    }
}

The System process data stream provides process statistics. One document is provided for each process. Refer to the Configuration section for more details on how to change the process configuration.

• FreeBSD
• Linux
• macOS
• Windows

Process execution data should be available for an authorized user. If running as less privileged user, it may not be able to read process data belonging to other users.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The process_summary data stream collects high level statistics about the running processes.

• FreeBSD
• Linux
• macOS
• Windows

General process summary data should be available without elevated permissions. If the process data belongs to the other users, it will be counted as unknown value.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System socket_summary data stream provides the summary of open network sockets in the host system.

It collects a summary of metrics with the count of existing TCP and UDP connections and the count of listening ports.

• FreeBSD
• Linux
• macOS
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

The System uptime data stream provides the uptime of the host operating system.

• Linux
• macOS
• OpenBSD
• FreeBSD
• Windows

This data should be available without elevated permissions.

ECS Field Reference

Please refer to the following document for detailed information on ECS fields.

Exported fields

Alert rule templates provide pre-defined configurations for creating alert rules in Kibana.

For more information, refer to the Elastic documentation.

Alert rule templates require Elastic Stack version 9.2.0 or later.

The following alert rule templates are available:

[System] CPU Utilization

[System] Disk I/O Saturation

[System] High Disk I/O Latency

[System] High Network Error Rate

[System] High Packet Drop Rate

[System] Memory Utilization