[Fleet] Update "Remote Elasticsearch output” #2048

vishaangelova · 2025-07-05T14:09:38Z

This PR is a review/update of the documentation created for [Fleet] Multi Cluster Fleet support - Phase 1: Global Visibility and Control, Local Data Plane, and updates the Remote Elasticsearch output doc with the following:

Updated the doc frontmatter to include applies_to
Removed references to specific subscriptions, added a reworded note in the “Automatic integrations synchronization” section
Clarified the remote address required for setting up a remote cluster
Added links to deploy-manage guides for setting up remote clusters and cross-cluster replication in the relevant sections
Restructured and updated the steps in the document for clarity and a more logical workflow
Added info about the available remote cluster data views in a new section
Added a new troubleshooting section

Closes elastic/ingest-docs#1817

Preview

reference/fleet/remote-elasticsearch-output.md

github-actions · 2025-07-05T14:11:46Z

🔍 Preview links for changed docs

reference/fleet/remote-elasticsearch-output.md

vishaangelova · 2025-07-05T20:26:01Z

reference/fleet/remote-elasticsearch-output.md

+applies_to:
+  stack: ga
+  deployment:
+    eck: ga


What deployments is this document valid for? Should the focus be on ECH, ECE and self-managed?

Yeah, I think ECH, ECE and self-managed sounds good.

vishaangelova · 2025-07-05T20:41:13Z

reference/fleet/remote-elasticsearch-output.md


 To configure a remote {{es}} cluster for your {{agent}} data:

-1. In {{fleet}}, open the **Settings** tab.
+1. In your main {{es}} cluster (Cluster A), open {{kib}}, and search for **Fleet settings** in the search bar. Select **Fleet/Settings** in the results.


Should we refer to the main cluster as the “management cluster" instead?

Yeah I think we can use "management cluster" here.

vishaangelova · 2025-07-05T21:15:29Z

reference/fleet/remote-elasticsearch-output.md

+
+    ::::{dropdown} Find the remote host address of the remote cluster
+    :open:
+    1. In the remote cluster (Cluster B), open {{kib}}, and search for **Fleet settings** in the search bar. Select **Fleet/Settings** in the results.


I thought using Cluster A and Cluster B to designate the main and remote clusters, respectively, could help users identify more easily the cluster where the step in question takes place. I’d appreciate any feedback on whether this is useful, or if it makes the doc more cumbersome to read.

I actually like this, but I can see the argument for cumbersome. I'd like to phone a friend. @karenzone what do you think of this approach?

juliaElastic · 2025-07-07T08:45:15Z

reference/fleet/remote-elasticsearch-output.md

+6. Choose whether integrations should be automatically synchronized on the remote {{es}} cluster (Cluster B). To configure this feature, refer to the [Automatic integrations synchronization](#automatic-integrations-synchronization) section.
+
+    ::::{note}
+    This feature is only available with certain subscriptions. For more information, check [Subscriptions](https://www.elastic.co/subscriptions).


Should we mention that minimum Enterprise license is required on both clusters? The subscriptions doc is not yet updated with this feature.

For legal reasons we can no longer call out specific subscription details in the docs. Do you know when this will be added to the subscriptions doc?

I'm not sure, do you know where to update the subscriptions doc? Can we do that directly?

bmorelli25

Great improvements. A few comments.

bmorelli25 · 2025-07-07T22:43:49Z

reference/fleet/remote-elasticsearch-output.md

+        GET fleet-synced-integrations-ccr-<output_name>/_search
+        ```
+
+        The response should match the the contents of the leader index on the main cluster.


Suggested change

The response should match the the contents of the leader index on the main cluster.

The response should match the contents of the leader index on the main cluster.

bmorelli25 · 2025-07-07T22:44:16Z

reference/fleet/remote-elasticsearch-output.md

+- `<remote_cluster>:logs-*`
+- `<remote_cluster>:metrics-*`
+
+To display these data views, open {{kib}} in your main {{es}} cluster, then go to **Management** -> **Stack management** → **Data Views**.


Suggested change

To display these data views, open {{kib}} in your main {{es}} cluster, then go to **Management** -> **Stack management** → **Data Views**.

To display these data views, open {{kib}} in your main {{es}} cluster, then go to **Management** → **Stack management** → **Data Views**.

bmorelli25 · 2025-07-07T22:44:56Z

reference/fleet/remote-elasticsearch-output.md

 4. Choose whether uninstalled integrations should also be uninstalled on the remote cluster.
+5. In the remote output configuration on the main cluster (Cluster A), add the {{kib}} URL of the remote cluster (Cluster B) in the **Remote Kibana URL** field.
+6. In the **Remote Kibana API Key** field, add an API key to access Kibana on the remote cluster (Cluster B).


key should be lowercase in this sentence and later ones

bmorelli25 · 2025-07-07T22:48:39Z

reference/fleet/remote-elasticsearch-output.md

-When you use a remote {{es}} output, {{fleet-server}} performs a test to ensure connectivity to the remote cluster. The result of that connectivity test is used to report the ES Remote output as healthy or unhealthy on the **Fleet** > **Settings** > **Outputs** page, under the **Status** column. In some cases, the remote {{es}} output used for data from {{agent}} may be reachable only by those agents and not by {{fleet-server}}, so the unhealthy state and an associated `Unable to connect` error that appears on the UI can be ignored.
+When you use a remote {{es}} output, {{fleet-server}} performs a test to ensure connectivity to the remote cluster. The result of that connectivity test is used to report whether the remote output is healthy or unhealthy, and is displayed on the **{{fleet}}** → **Settings** → **Outputs** page, in the **Status** column.
+
+In some cases, the remote {{es}} output used for {{agent}} data can be reached by the {{agent}}s but not by {{fleet-server}}. In those cases, you can ignore the resulting unhealthy state of the output and the associated `Unable to connect` error on the UI.
 ::::

 ## Automatic integrations synchronization


IIUC, this is an optional feature with its own set of prereq's (like CCR). I wonder if this should be moved to its own page. It's 2/3 of the content on this page as is.

bmorelli25 · 2025-07-07T22:50:29Z

reference/fleet/remote-elasticsearch-output.md


-## Configuration
+## Configuration [remote-output-config]


You could consider using a stepper here to make the flow stand out more.

vishaangelova requested a review from a team as a code owner July 5, 2025 14:09

github-actions bot deployed to docs-preview July 5, 2025 14:10 View deployment

github-actions bot deployed to docs-preview July 5, 2025 14:24 View deployment

vishaangelova requested review from kpollich, juliaElastic, nimarezainia and criamico July 5, 2025 14:29

github-actions bot deployed to docs-preview July 5, 2025 14:47 View deployment

github-actions bot had a problem deploying to docs-preview July 5, 2025 14:50 Failure

vishaangelova force-pushed the 1817-cross-cluster-integration-updates branch from 2a6364e to 564d582 Compare July 5, 2025 14:50

github-actions bot deployed to docs-preview July 5, 2025 14:51 View deployment

vishaangelova marked this pull request as draft July 5, 2025 19:06

vishaangelova force-pushed the 1817-cross-cluster-integration-updates branch from 564d582 to a88458e Compare July 5, 2025 20:21

github-actions bot deployed to docs-preview July 5, 2025 20:22 View deployment

vishaangelova commented Jul 5, 2025

View reviewed changes

Update the "Remote Elasticsearch output" doc

a21b40e

vishaangelova force-pushed the 1817-cross-cluster-integration-updates branch from a88458e to a21b40e Compare July 5, 2025 21:47

github-actions bot deployed to docs-preview July 5, 2025 21:47 View deployment

vishaangelova marked this pull request as ready for review July 5, 2025 21:54

juliaElastic reviewed Jul 7, 2025

View reviewed changes

bmorelli25 reviewed Jul 7, 2025

View reviewed changes

	The response should match the the contents of the leader index on the main cluster.
	The response should match the contents of the leader index on the main cluster.

	To display these data views, open {{kib}} in your main {{es}} cluster, then go to Management -> Stack management → Data Views.
	To display these data views, open {{kib}} in your main {{es}} cluster, then go to Management → Stack management → Data Views.

[Fleet] Update "Remote Elasticsearch output” #2048

Are you sure you want to change the base?

[Fleet] Update "Remote Elasticsearch output” #2048

Uh oh!

Conversation

vishaangelova commented Jul 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preview

Uh oh!

github-actions bot commented Jul 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

vishaangelova Jul 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vishaangelova Jul 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vishaangelova Jul 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bmorelli25 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vishaangelova commented Jul 5, 2025 •

edited

Loading

github-actions bot commented Jul 5, 2025 •

edited

Loading

vishaangelova Jul 5, 2025 •

edited

Loading

vishaangelova Jul 5, 2025 •

edited

Loading

vishaangelova Jul 5, 2025 •

edited

Loading