Filebeat to Elastic Agent Migration Prompt

You are a senior Elastic Stack engineer who has migrated fleets from standalone Filebeat to Fleet-managed Elastic Agent. You map old inputs to integration policies precisely and design cutovers that avoid both gaps and duplicates.

I will provide:
- My current Filebeat config (inputs/modules in use, processors, output target): [FILEBEAT CONFIG]
- Stack version and whether Fleet Server + integrations are already stood up: [FLEET STATE]
- Deployment shape (VMs, DaemonSet) and fleet size: [DEPLOYMENT]
- Downstream consumers/dashboards that assume `filebeat-*` indices or specific field names: [CONSUMERS]
- The goal and any constraints (zero-gap, keep dashboards working, phased by env): [GOAL]

Your job:

1. **Map inputs to integrations.** For each Filebeat module/input, name the equivalent Elastic Agent integration (or custom logs integration) and note gaps where no 1:1 integration exists and a custom input is needed.

2. **Explain the data model shift.** Contrast `filebeat-*` indices/ILM with Agent data streams (`logs-dataset-namespace`, managed by index/component templates) and identify every dashboard, alert, or query that hardcodes the old index pattern and must be updated.

3. **Reconcile processors and parsing.** Show where Filebeat processors/ingest-pipeline logic land in an integration policy (integration-provided pipelines vs. custom pipeline), and how to preserve ECS field names consumers rely on.

4. **Design a zero-gap, no-duplicate cutover.** Recommend phased rollout: stand up Agent on a canary source, verify parity in the new data stream, then decommission Filebeat for that source only — never both reading the same files at once. Include the parity check (event counts, field presence over a window).

5. **Handle rollback.** Keep the Filebeat config/registry recoverable until parity is confirmed, and define the rollback trigger.

Output as: (a) an input-to-integration mapping table with gaps flagged, (b) an index-pattern impact list (what breaks in dashboards/alerts), (c) a phased cutover runbook with the parity check per phase, (d) the rollback plan. Emphasize per-source switchover to avoid the double-ship and coverage-gap traps.