# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Elastic Agents Update Issue Behind Proxy](https://discuss.elastic.co/t/elastic-agents-update-issue-behind-proxy/362361)
**Author:** [@werheids](https://discuss.elastic.co/u/werheids)\ **Replies:** 6\ **Last updated:** [June 12, 2026, 5:36pm UTC](https://discuss.elastic.co/t/elastic-agents-update-issue-behind-proxy/362361 "2026-06-12T17:36:33Z")
Hello, I'm having an issue where my Elastic Agents are unable to update. The following error occurs: \[elastic\_agent\]\[warn\] unable to download package: 2 errors occurred: \* package '/opt/Elastic/Agent/data/elastic-agen… --- ## [Configuring verification\_mode for Elastic Agent & Fleet Server](https://discuss.elastic.co/t/configuring-verification-mode-for-elastic-agent-fleet-server/386764)
**Author:** [@Reviving9721](https://discuss.elastic.co/u/Reviving9721)\ **Replies:** 0\ **Last updated:** [June 8, 2026, 8:45pm UTC](https://discuss.elastic.co/t/configuring-verification-mode-for-elastic-agent-fleet-server/386764 "2026-06-08T20:45:18Z")
Take the following configuration as an example reference: fleet: ... server: host: 0.0.0.0 internal\_port: 8221 output: elasticsearch: hosts: - 192.168.122.196:9200 protocol:… --- ## [9.4.1 Agent Update on Windows get's orphaned](https://discuss.elastic.co/t/9-4-1-agent-update-on-windows-gets-orphaned/386535)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 5\ **Last updated:** [June 8, 2026, 3:55am UTC](https://discuss.elastic.co/t/9-4-1-agent-update-on-windows-gets-orphaned/386535 "2026-06-08T03:55:15Z")
I regularly update my Elastic environment. Upgrading to version 9.4.1 was somewhat painful due to the “CPU flag” issue, but with the help of the forum, I was able to get everything back up and running. After that, I pro… --- ## [Duplicate Elastic Agent metrics → 409 conflicts in Logstash (.metrics-\* only)](https://discuss.elastic.co/t/duplicate-elastic-agent-metrics-409-conflicts-in-logstash-metrics-only/386672)
**Author:** [@username456](https://discuss.elastic.co/u/username456)\ **Replies:** 0\ **Last updated:** [June 3, 2026, 7:40am UTC](https://discuss.elastic.co/t/duplicate-elastic-agent-metrics-409-conflicts-in-logstash-metrics-only/386672 "2026-06-03T07:40:53Z")
Hello, We are currently experiencing an issue with Fleet-managed Elastic Agent where metrics are being sent twice, resulting in 409 version conflict errors in Logstash. We have not been able to identify the cause of thi… --- ## [Free Elasticsearch MCP Server with a Semantic-to-Lexical layer for Business rules](https://discuss.elastic.co/t/free-elasticsearch-mcp-server-with-a-semantic-to-lexical-layer-for-business-rules/386456)
**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Replies:** 0\ **Last updated:** [May 22, 2026, 12:45pm UTC](https://discuss.elastic.co/t/free-elasticsearch-mcp-server-with-a-semantic-to-lexical-layer-for-business-rules/386456 "2026-05-22T12:45:44Z")
Hello guys, this is A generic Model Context Protocol (MCP) server that connects LLMs to Elasticsearch, with a Semantic-to-Lexical (S2L) layer that translates technical field names into business knowledge — without har… --- ## [Airgap standalone Elastic Agent Upgrade](https://discuss.elastic.co/t/airgap-standalone-elastic-agent-upgrade/386355)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 2\ **Last updated:** [May 21, 2026, 6:50am UTC](https://discuss.elastic.co/t/airgap-standalone-elastic-agent-upgrade/386355 "2026-05-21T06:50:31Z")
I'm running a standalone agent on an airgap Windows system using the zip deployment. I'm trying to upgrade from 8.19.0 to 8.19.15 as a test. It appears that there is a way to use the elastic-agent.exe upgrade command wi… --- ## [MQTT Integration using Elastc Agent](https://discuss.elastic.co/t/mqtt-integration-using-elastc-agent/358653)
**Author:** [@allatrue](https://discuss.elastic.co/u/allatrue)\ **Replies:** 1\ **Last updated:** [May 19, 2026, 11:18am UTC](https://discuss.elastic.co/t/mqtt-integration-using-elastc-agent/358653 "2026-05-19T11:18:02Z")
Hi all, I'm wondering, if there is an integration for Elastic Agent to collect data from MQTT-Broker? It's possible with filebeat, but how can I configure it in Elastic Agent managed by Fleet? Thanks, Regards --- ## [Elastic APM Agent - CVE-2026-34480](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100)
**Author:** [@leoluzh](https://discuss.elastic.co/u/leoluzh)\ **Replies:** 3\ **Last updated:** [May 18, 2026, 8:09pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100 "2026-05-18T20:09:52Z")
When running a NeuVector scan, CVE-2026-34480 was found in the elastic-apm-agent artifact (version 1.55.6) for the log4j-core dependency. Vulnerabilities: 5, HIGH: 1, MEDIUM: 3, LOW: 1, UNKNOWN: 0 File: app/libs/apm-ag… --- ## [Collect Kubernetes audit logs from local files only if node label exists via fleet](https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344)
**Author:** [@AndrewDatTeranet](https://discuss.elastic.co/u/AndrewDatTeranet)\ **Replies:** 0\ **Last updated:** [May 14, 2026, 6:10pm UTC](https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344 "2026-05-14T18:10:16Z")
While trying to set up the "Collect Kubernetes audit logs from local files" with the Kubernetes integration in fleet, I was trying to add a condition to only collect logs if the node label kubernetes.labels.node-role\_kub… --- ## [The Agents Health is not stable](https://discuss.elastic.co/t/the-agents-health-is-not-stable/386202)
**Author:** [@5037\_DHIVAGAR\_S](https://discuss.elastic.co/u/5037_DHIVAGAR_S)\ **Replies:** 0\ **Last updated:** [May 7, 2026, 5:09am UTC](https://discuss.elastic.co/t/the-agents-health-is-not-stable/386202 "2026-05-07T05:09:08Z")
Hi Everyone, We are using Elastic Cloud (SaaS) with Fleet-managed Elastic Agents on Windows servers. Some of our agents are intermittently switching between Healthy and Unhealthy states, and the status is not stable. I… --- ## [No data/log from elastic agent on Security onion](https://discuss.elastic.co/t/no-data-log-from-elastic-agent-on-security-onion/386140)
**Author:** [@Mojamed\_Pika\_SANOGO](https://discuss.elastic.co/u/Mojamed_Pika_SANOGO)\ **Replies:** 4\ **Last updated:** [May 6, 2026, 7:58pm UTC](https://discuss.elastic.co/t/no-data-log-from-elastic-agent-on-security-onion/386140 "2026-05-06T19:58:07Z")
Hi, I need help. I installed Elastic Agent on Windows machines for monitoring on Security Onion. I chose the distributed mode. Although the agents appear in Fleet and are in a healthy state, and I've integrated Elastic D… --- ## [EDOT otel collector not working on read-only filesystem](https://discuss.elastic.co/t/edot-otel-collector-not-working-on-read-only-filesystem/385897)
**Author:** [@Jaybee18](https://discuss.elastic.co/u/Jaybee18)\ **Replies:** 1\ **Last updated:** [May 5, 2026, 11:10am UTC](https://discuss.elastic.co/t/edot-otel-collector-not-working-on-read-only-filesystem/385897 "2026-05-05T11:10:54Z")
Hello, we want to deploy the elastic agent (or rather the EDOT collector) in otel mode in our cluster but with a read-only root filesystem. It seems that this is currently not possible. We get the following error: fail… --- ## [Can i use the same fleet server policy to enroll two fleet servers for HA?](https://discuss.elastic.co/t/can-i-use-the-same-fleet-server-policy-to-enroll-two-fleet-servers-for-ha/386106)
**Author:** [@Mansi\_Sharma1](https://discuss.elastic.co/u/Mansi_Sharma1)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 9:32pm UTC](https://discuss.elastic.co/t/can-i-use-the-same-fleet-server-policy-to-enroll-two-fleet-servers-for-ha/386106 "2026-04-30T21:32:43Z")
Hello, I have two VMs where i want to setup my fleet servers. VM1 as Fleet1 and VM2 as Fleet2 I have a Load Balancer for that too. i am wondering if i can use the only one fleet server policy for enrolling both of th… --- ## [Data from server is not flowing from elastic agent to elastic](https://discuss.elastic.co/t/data-from-server-is-not-flowing-from-elastic-agent-to-elastic/385333)
**Author:** [@sathish12](https://discuss.elastic.co/u/sathish12)\ **Replies:** 5\ **Last updated:** [April 28, 2026, 2:16pm UTC](https://discuss.elastic.co/t/data-from-server-is-not-flowing-from-elastic-agent-to-elastic/385333 "2026-04-28T14:16:46Z")
I have installed fleet server in one machine and server agent to collect logs and metrics in one web server. for the both the agents I have created respective default policies and integration. For web server, I have prov… --- ## [Crowdstrike Integration Degraded](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385987)
**Author:** [@4l13v](https://discuss.elastic.co/u/4l13v)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 1:23pm UTC](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385987 "2026-04-22T13:23:18Z")
The problem is 3 months ago, I have integrated Crowdstrike via API. It okay, and I am getting alerts from Falcon without problems. But Fleet server came unhealthy in these days. {failed to decode discover body: EOF} . … --- ## [Elastic Agent Poll time adjusting](https://discuss.elastic.co/t/elastic-agent-poll-time-adjusting/385882)
**Author:** [@etrevino-lumificyber](https://discuss.elastic.co/u/etrevino-lumificyber)\ **Replies:** 0\ **Last updated:** [April 14, 2026, 2:39pm UTC](https://discuss.elastic.co/t/elastic-agent-poll-time-adjusting/385882 "2026-04-14T14:39:29Z")
Hello everyone, I have a client who would like an option to adjust the amount of web requests going outbound from the elastic agent. I recommended adding filters on their end to drop those logs in Cisco Umbrella. Is the… --- ## [Qualys VMDR Integration Missing Data](https://discuss.elastic.co/t/qualys-vmdr-integration-missing-data/385834)
**Author:** [@difi80211g](https://discuss.elastic.co/u/difi80211g)\ **Replies:** 1\ **Last updated:** [April 10, 2026, 5:49am UTC](https://discuss.elastic.co/t/qualys-vmdr-integration-missing-data/385834 "2026-04-10T05:49:10Z")
I have setup the Qualys VMDR integration and all checks seem to be fine, however i am not getting any asset or KB data, but i am getting the User activity logs. I verified permissions in qualys and api logs in qualys bu… --- ## [Elastic Stack Self-Managed Multi-Node – Fleet Server TLS](https://discuss.elastic.co/t/elastic-stack-self-managed-multi-node-fleet-server-tls/384902)
**Author:** [@4l13v](https://discuss.elastic.co/u/4l13v)\ **Replies:** 1\ **Last updated:** [April 9, 2026, 1:10pm UTC](https://discuss.elastic.co/t/elastic-stack-self-managed-multi-node-fleet-server-tls/384902 "2026-04-09T13:10:19Z")
I am running a self-managed Elastic Stack (8.x) on a private network and trying to deploy Fleet Server with production TLS certificates. I am facing certificate trust and agent enrollment issues. Then I saw on documenta… --- ## [Elastic Agent 9.2.7 Error: failed to execute enroll command](https://discuss.elastic.co/t/elastic-agent-9-2-7-error-failed-to-execute-enroll-command/385818)
**Author:** [@Faza\_Syarof](https://discuss.elastic.co/u/Faza_Syarof)\ **Replies:** 1\ **Last updated:** [April 9, 2026, 6:35am UTC](https://discuss.elastic.co/t/elastic-agent-9-2-7-error-failed-to-execute-enroll-command/385818 "2026-04-09T06:35:28Z")
Hi, Please help me, I try to reinstall fleet server but got error I already uninstall with command : elastic-agent uninstall and remove folder under /opt/Elastic but still got error below \[ \] Failed to Enroll \[0s\]… --- ## [Elastic-agent stuck in offline status](https://discuss.elastic.co/t/elastic-agent-stuck-in-offline-status/385697)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 1\ **Last updated:** [April 3, 2026, 5:59am UTC](https://discuss.elastic.co/t/elastic-agent-stuck-in-offline-status/385697 "2026-04-03T05:59:14Z")
Dear Elastic Community i have elastic agent installed on linux on the host elastic-agent status showing Healthy/running but in fleet server UI it showing always offline ,i did re-installation of the agent but still offl… --- ## [Elastic-Agent -\> Logstash high EPS missing events](https://discuss.elastic.co/t/elastic-agent-logstash-high-eps-missing-events/385733)
**Author:** [@mamueh](https://discuss.elastic.co/u/mamueh)\ **Replies:** 0\ **Last updated:** [April 1, 2026, 2:05pm UTC](https://discuss.elastic.co/t/elastic-agent-logstash-high-eps-missing-events/385733 "2026-04-01T14:05:40Z")
Hi Everyone We have a rather large setup in which we’ve replaced rsyslog with Elastic Agents as log collectors. We’re running 8.19.8. Currently we have around 1200 devices forwarding mostly syslog to a load balancer th… --- ## [Change agent fingerprint / certificate](https://discuss.elastic.co/t/change-agent-fingerprint-certificate/385638)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 4\ **Last updated:** [March 27, 2026, 12:38pm UTC](https://discuss.elastic.co/t/change-agent-fingerprint-certificate/385638 "2026-03-27T12:38:06Z")
No - i am not an “elastic crack” but a stupid beginner. I am hosting my elastic - fleet managed - environment to better understand how SIEM is working. Well - after my certificates got invalid / got outdated i decided t… --- ## [Palo Alto Ingest Pipeline: Audit Logs](https://discuss.elastic.co/t/palo-alto-ingest-pipeline-audit-logs/385588)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [March 23, 2026, 9:49pm UTC](https://discuss.elastic.co/t/palo-alto-ingest-pipeline-audit-logs/385588 "2026-03-23T21:49:36Z")
The 2 Grok patterns supplied in the PANW ingest pipelines are not sufficient for parsing audit logs. I have created the grok pattern required to parse PANW audit logs and even submitted a merge request, but no one ever l… --- ## [Issue with Hashicorp Vault/Elastic agent integration](https://discuss.elastic.co/t/issue-with-hashicorp-vault-elastic-agent-integration/385550)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 0\ **Last updated:** [March 20, 2026, 6:32pm UTC](https://discuss.elastic.co/t/issue-with-hashicorp-vault-elastic-agent-integration/385550 "2026-03-20T18:32:09Z")
I have the Hashicorp Vault integration assigned to all of my Vault servers. I seem to be collecting the operational and audit logs with no issue, but there are gaps in the metric data. For example, the agent is not pick… --- ## [(Email) Notifications for Agent Status Change](https://discuss.elastic.co/t/email-notifications-for-agent-status-change/385528)
**Author:** [@RalphDibney](https://discuss.elastic.co/u/RalphDibney)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 2:50pm UTC](https://discuss.elastic.co/t/email-notifications-for-agent-status-change/385528 "2026-03-19T14:50:38Z")
Elastic Onprem 8.19.12 We are currently preparing to rollout Elastic Defend on all our systems. Since this makes the Elastic installation on the agent absolutly security critical, we want to be informed about the status… --- ## [Filebeat to Elastic-Agent Swap](https://discuss.elastic.co/t/filebeat-to-elastic-agent-swap/385490)
**Author:** [@kamandohl](https://discuss.elastic.co/u/kamandohl)\ **Replies:** 6\ **Last updated:** [March 19, 2026, 11:30am UTC](https://discuss.elastic.co/t/filebeat-to-elastic-agent-swap/385490 "2026-03-19T11:30:17Z")
We currently are utilizing Filebeat 8.13.x to ship sensor data for Zeek and Suricata via Kafka and utilizing Logstash to subscribe from Kafka and push to Elasticsearch. We are in the mist of moving from filebeat to ela… --- ## [Unhelathy host ](https://discuss.elastic.co/t/unhelathy-host/385494)
**Author:** [@a.thiome](https://discuss.elastic.co/u/a.thiome)\ **Replies:** 2\ **Last updated:** [March 18, 2026, 1:58am UTC](https://discuss.elastic.co/t/unhelathy-host/385494 "2026-03-18T01:58:58Z")
I recently installed the Elastic Stack and used Fleet to add hosts, but all Windows and Linux hosts appear as unhealthy. Has anyone else encountered this issue? --- ## [Oracle Integration condition](https://discuss.elastic.co/t/oracle-integration-condition/385431)
**Author:** [@hubkos](https://discuss.elastic.co/u/hubkos)\ **Replies:** 4\ **Last updated:** [March 17, 2026, 9:51pm UTC](https://discuss.elastic.co/t/oracle-integration-condition/385431 "2026-03-17T21:51:49Z")
Hi all, is there a possibility to add a condition for Oracle Integration? Just like PostgreSQL has one, I’d like to “activate” Oracle Integration based on agent Providers. Thanks and greetings, Hubert --- ## [Multi ES Clusters vs single Fleet Service](https://discuss.elastic.co/t/multi-es-clusters-vs-single-fleet-service/385455)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 5\ **Last updated:** [March 15, 2026, 3:40pm UTC](https://discuss.elastic.co/t/multi-es-clusters-vs-single-fleet-service/385455 "2026-03-15T15:40:21Z")
Hi, Currently in progress of migrating from standalone beats to Fleet Agent Policies. Currently got a Custom Application Observability production ES cluster and a remote monitoring ES cluster, both Air Gapped v.8.19 cl… --- ## [Where to find the Custom Logs (Filestream) integration?](https://discuss.elastic.co/t/where-to-find-the-custom-logs-filestream-integration/385446)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 6\ **Last updated:** [March 15, 2026, 12:36pm UTC](https://discuss.elastic.co/t/where-to-find-the-custom-logs-filestream-integration/385446 "2026-03-15T12:36:00Z")
We’re trying to run an Air Gapped EPR registry v.1.37.0 with a minimal set of selected integration packages, but kibana v.8.19.9 first of all shows a larger(e) set of integrations (wondering why?) to select among in th… [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=2)