diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index 830d1372c..6fa356c61 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -60,6 +60,380 @@ elasticsearch:
         elasticsearch:
           deprecation: ERROR
   index_settings:
+    so-logs-elastic_agent.apm_server:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.apm_server-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.apm_server@package"
+          - "so-logs-elastic_agent.apm_server@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent.auditbeat:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.auditbeat-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.auditbeat@package"
+          - "so-logs-elastic_agent.auditbeat@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent.cloudbeat:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.cloudbeat-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.cloudbeat@package"
+          - "so-logs-elastic_agent.cloudbeat@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false    
+    so-logs-elastic_agent.endpoint_security:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.endpoint_security-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.endpoint_security@package"
+          - "so-logs-elastic_agent.endpoint_security@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent.filebeat:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.filebeat-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.filebeat@package"
+          - "so-logs-elastic_agent.filebeat@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent.fleet_server:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.fleet_server-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.fleet_server@package"
+          - "so-logs-elastic_agent.fleet_server@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent.heartbeat:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.heartbeat-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.heartbeat@package"
+          - "so-logs-elastic_agent.heartbeat@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent@package"
+          - "so-logs-elastic_agent@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent.metricbeat:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.metricbeat-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.metricbeat@package"
+          - "so-logs-elastic_agent.metricbeat@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent.osquerybeat:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.osquerybeat-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.osquerybeat@package"
+          - "so-logs-elastic_agent.osquerybeat@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
+    so-logs-elastic_agent.packetbeat:
+      index_sorting: False
+      index_template:
+        index_patterns:
+          - "logs-elastic_agent.packetbeat-*"
+        template:
+          settings:
+            index:
+              mapping:
+                total_fields:
+                  limit: 5000
+              sort:
+                field: "@timestamp"
+                order: desc
+          mappings:
+            _meta:
+              package:
+                name: elastic_agent
+              managed_by: fleet
+              managed: true
+        composed_of:
+          - "so-logs-elastic_agent.packetbeat@package"
+          - "so-logs-elastic_agent.packetbeat@custom"
+          - ".fleet_globals-1"
+          - ".fleet_agent_id_verification-1"
+        priority: 500
+        _meta:
+          package:
+            name: elastic_agent
+          managed_by: fleet
+          managed: true
+        data_stream:
+          hidden: false
+          allow_custom_routing: false
     so-aws:
       warm: 7
       close: 30
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.apm_server@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.apm_server@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.apm_server@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.apm_server@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.apm_server@package.json
new file mode 100644
index 000000000..9fd8c928f
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.apm_server@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+    "analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.auditbeat@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.auditbeat@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.auditbeat@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.auditbeat@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.auditbeat@package.json
new file mode 100644
index 000000000..9fd8c928f
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.auditbeat@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+    "analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.cloudbeat@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.cloudbeat@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.cloudbeat@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.cloudbeat@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.cloudbeat@package.json
new file mode 100644
index 000000000..c4874ed3c
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.cloudbeat@package.json
@@ -0,0 +1,510 @@
+{
+  "template": {
+    "settings": {
+"analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "ignore_above": 1024,
+          "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.endpoint_security@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.endpoint_security@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.endpoint_security@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.endpoint_security@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.endpoint_security@package.json
new file mode 100644
index 000000000..36978b0d8
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.endpoint_security@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+"analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.filebeat@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.filebeat@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.filebeat@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.filebeat@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.filebeat@package.json
new file mode 100644
index 000000000..36978b0d8
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.filebeat@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+"analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.fleet_server@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.fleet_server@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.fleet_server@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.fleet_server@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.fleet_server@package.json
new file mode 100644
index 000000000..36978b0d8
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.fleet_server@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+"analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.heartbeat@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.heartbeat@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.heartbeat@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.heartbeat@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.heartbeat@package.json
new file mode 100644
index 000000000..f353ac542
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.heartbeat@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+"analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.metricbeat@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.metricbeat@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.metricbeat@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.metricbeat@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.metricbeat@package.json
new file mode 100644
index 000000000..36978b0d8
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.metricbeat@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+"analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.osquerybeat@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.osquerybeat@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.osquerybeat@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.osquerybeat@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.osquerybeat@package.json
new file mode 100644
index 000000000..36978b0d8
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.osquerybeat@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+"analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.packetbeat@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.packetbeat@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.packetbeat@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.packetbeat@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.packetbeat@package.json
new file mode 100644
index 000000000..9e593d3f8
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent.packetbeat@package.json
@@ -0,0 +1,498 @@
+{
+  "template": {
+    "settings": {
+"analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+      "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent@custom.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent@custom.json
new file mode 100644
index 000000000..fe77af1db
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent@custom.json
@@ -0,0 +1,12 @@
+{
+  "template": {
+    "settings": {}
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent@package.json b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent@package.json
new file mode 100644
index 000000000..7df3309b1
--- /dev/null
+++ b/salt/elasticsearch/templates/component/elastic-agent/logs-elastic_agent@package.json
@@ -0,0 +1,505 @@
+{
+  "template": {
+    "settings": {
+ "analysis": {
+        "analyzer": {
+          "es_security_analyzer": {
+            "type": "custom",
+            "char_filter": [
+              "whitespace_no_way"
+            ],
+            "filter": [
+              "lowercase",
+              "trim"
+            ],
+            "tokenizer": "keyword"
+          }
+        },
+        "char_filter": {
+          "whitespace_no_way": {
+            "type": "pattern_replace",
+            "pattern": "(\\s)+",
+            "replacement": "$1"
+          }
+        },
+        "filter": {
+          "path_hierarchy_pattern_filter": {
+            "type": "pattern_capture",
+            "preserve_original": true,
+            "patterns": [
+              "((?:[^\\\\]*\\\\)*)(.*)",
+              "((?:[^/]*/)*)(.*)"
+            ]
+          }
+        },
+        "tokenizer": {
+            "path_tokenizer": {
+              "type": "path_hierarchy",
+              "delimiter": "\\"
+            }
+          }
+        },
+     "index": {
+        "lifecycle": {
+          "name": "logs"
+        },
+        "codec": "best_compression",
+        "mapping": {
+          "total_fields": {
+            "limit": "10000"
+          }
+        },
+        "query": {
+          "default_field": [
+            "cloud.account.id",
+            "cloud.availability_zone",
+            "cloud.instance.id",
+            "cloud.instance.name",
+            "cloud.machine.type",
+            "cloud.provider",
+            "cloud.region",
+            "cloud.project.id",
+            "cloud.image.id",
+            "container.id",
+            "container.image.name",
+            "container.name",
+            "host.architecture",
+            "host.domain",
+            "host.hostname",
+            "host.id",
+            "host.mac",
+            "host.name",
+            "host.os.family",
+            "host.os.kernel",
+            "host.os.name",
+            "host.os.platform",
+            "host.os.version",
+            "host.os.build",
+            "host.os.codename",
+            "host.type",
+            "log.level",
+            "message",
+            "elastic_agent.id",
+            "elastic_agent.process",
+            "elastic_agent.version"
+          ]
+        }
+      }
+    },
+    "mappings": {
+      "dynamic": false,
+      "properties": {
+        "cloud": {
+          "properties": {
+            "availability_zone": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "image": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "instance": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "provider": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "machine": {
+              "properties": {
+                "type": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "project": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "region": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "account": {
+              "properties": {
+                "id": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            }
+          }
+        },
+        "container": {
+          "properties": {
+            "image": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "labels": {
+              "type": "object"
+            }
+          }
+        },
+        "@timestamp": {
+          "type": "date"
+        },
+        "ecs": {
+          "properties": {
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "log": {
+          "properties": {
+            "level": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "data_stream": {
+          "properties": {
+            "namespace": {
+              "type": "constant_keyword"
+            },
+            "type": {
+              "type": "constant_keyword"
+            },
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "hostname": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "os": {
+              "properties": {
+                "build": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "kernel": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "codename": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword",
+                  "fields": {
+
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"},
+                    "text": {
+                      "type": "text"
+                    }
+                  }
+                },
+                "family": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "version": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                },
+                "platform": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+                }
+              }
+            },
+            "domain": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "ip": {
+              "type": "ip"
+            },
+            "containerized": {
+              "type": "boolean"
+            },
+            "name": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "type": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "mac": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "architecture": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            }
+          }
+        },
+        "elastic_agent": {
+          "properties": {
+            "process": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "version": {
+              "ignore_above": 1024,
+              "type": "keyword"
+,
+"fields": {
+"security": {
+"type": "text",
+"analyzer": "es_security_analyzer"}
+}
+            },
+            "snapshot": {
+              "type": "boolean"
+            }
+          }
+        },
+        "event": {
+          "properties": {
+            "dataset": {
+              "type": "constant_keyword"
+            }
+          }
+        },
+        "message": {
+          "type": "text"
+        }
+      }
+    }
+  },
+  "_meta": {
+    "package": {
+      "name": "elastic_agent"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  }
+}
diff --git a/salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load b/salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load
index e341c3d40..cb727a5d3 100755
--- a/salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load
+++ b/salt/elasticsearch/tools/sbin/so-elasticsearch-templates-load
@@ -1,9 +1,7 @@
 #!/bin/bash
 # Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
-# or more contributor license agreements. Licensed under the Elastic License 2.0 as shown at 
-# https://securityonion.net/license; you may not use this file except in compliance with the
-# Elastic License 2.0.
-
+# or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use
+# this file except in compliance with the Elastic License 2.0.
 
 
 {%- set mainint = salt['pillar.get']('host:mainint') %}
@@ -44,6 +42,11 @@ cd ${ELASTICSEARCH_TEMPLATES}/component/ecs
 echo "Loading ECS component templates..."
 for i in *; do TEMPLATE=$(echo $i | cut -d '.' -f1); echo "$TEMPLATE-mappings"; so-elasticsearch-query _component_template/$TEMPLATE-mappings -d@$i -XPUT 2>/dev/null; echo; done
 
+cd ${ELASTICSEARCH_TEMPLATES}/component/elastic-agent
+
+echo "Loading Elastic Agent component templates..."
+for i in *; do TEMPLATE=${i::-5}; echo "so-$TEMPLATE"; so-elasticsearch-query _component_template/so-$TEMPLATE -d@$i -XPUT 2>/dev/null; echo; done
+
 # Load SO-specific component templates
 cd ${ELASTICSEARCH_TEMPLATES}/component/so