Skip to content

Choose a data onboarding path

Choose an ingestion path only after confirming that its endpoint and component are exposed by your deployment. A URL in source code is not proof that the corresponding service is enabled in your Marketplace plan.

Azure data-ingestion architecture showing applications, servers, Kubernetes, and Azure services using OpenTelemetry Collector, Elastic Agent and Fleet, Logstash, or an Elasticsearch API client to reach managed Elasticsearch data streams and Kibana.

Customers operate the source applications and collection layer. The managed platform receives approved TLS-protected ingestion traffic.

Compare onboarding paths

Source Starting path Verify before production
Application telemetry OpenTelemetry Collector in gateway mode Elastic version, OTLP support, API-key privileges, TLS, batching, and back pressure
Servers and virtual machines Elastic Agent managed by Fleet Fleet and Fleet Server endpoints, supported Agent version, egress, certificate trust, and policy ownership
Kubernetes OpenTelemetry Collector or Elastic Agent DaemonSet or gateway design, namespaces, metadata policy, network egress, and resource limits
Application search documents Elasticsearch API and a data stream or index mapping, template, API-key scope, document identity, lifecycle, and retry behavior
Existing pipelines Logstash exposed endpoint, plugin versions, persistent queue, TLS, and credential rotation
Azure services Verified Elastic integration or Event Hubs path service-specific integration, Event Hubs permissions, checkpointing, and cost
Network and appliance logs Elastic Agent integration or controlled syslog collector transport security, parsing, buffering, and source identity
Existing Elasticsearch Planned migration or reindex process version compatibility, mappings, templates, security, downtime, validation, and rollback

Make the onboarding decision

Record:

  1. data owner and classification;
  2. expected events or documents per second and daily volume;
  3. retention and deletion requirements;
  4. approved source and destination network paths;
  5. deployment-derived endpoint and certificate chain;
  6. least-privilege credential owner and rotation interval;
  7. index template, data stream, or integration owner;
  8. failure buffering, retry, and duplicate-handling behavior;
  9. validation queries and dashboards;
  10. support boundary for the source collector or application.

For a complete example, use onboard observability data or onboard search data.