# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=10 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 11 --- ## [Registry logs don't get to elastic](https://discuss.elastic.co/t/registry-logs-dont-get-to-elastic/374647)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 0\ **Last updated:** [February 17, 2025, 4:13pm UTC](https://discuss.elastic.co/t/registry-logs-dont-get-to-elastic/374647 "2025-02-17T16:13:19Z")
Hi, I've been trying to get registry changes to show up in elastic but despite having everything working locally and all other logs getting sent over, all registry-related events seem to be ignored and I have nothing on … --- ## [Cannot checking in with fleet-server](https://discuss.elastic.co/t/cannot-checking-in-with-fleet-server/374627)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 0\ **Last updated:** [February 17, 2025, 12:43pm UTC](https://discuss.elastic.co/t/cannot-checking-in-with-fleet-server/374627 "2025-02-17T12:43:58Z")
Hello everyone, For a long time, I was running a Fleet server on a virtual machine. Recently, I switched to running the Fleet server in a container using the Elastic image: elastic/elastic-agent. Intermittently, agent… --- ## [Collect O365 logs over a longer period of time](https://discuss.elastic.co/t/collect-o365-logs-over-a-longer-period-of-time/374552)
**Author:** [@Paf](https://discuss.elastic.co/u/Paf)\ **Replies:** 5\ **Last updated:** [February 14, 2025, 5:38pm UTC](https://discuss.elastic.co/t/collect-o365-logs-over-a-longer-period-of-time/374552 "2025-02-14T17:38:58Z")
Hello, I use fleet integration for collect o365 audit logs and i want to collect 1 month of logs. The "Initial Interval" parameter has maximum value of 7 days. Is it possible to extend this duration or is there a way … --- ## [License for multiple output than the default](https://discuss.elastic.co/t/license-for-multiple-output-than-the-default/374436)
**Author:** [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\ **Replies:** 1\ **Last updated:** [February 12, 2025, 4:50pm UTC](https://discuss.elastic.co/t/license-for-multiple-output-than-the-default/374436 "2025-02-12T16:50:40Z")
as per above query, can someone please tell which type of license is required for this feature --- ## [Elastic agent configuration for netflow traffic](https://discuss.elastic.co/t/elastic-agent-configuration-for-netflow-traffic/374431)
**Author:** [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\ **Replies:** 0\ **Last updated:** [February 12, 2025, 2:07pm UTC](https://discuss.elastic.co/t/elastic-agent-configuration-for-netflow-traffic/374431 "2025-02-12T14:07:29Z")
below is my elastic-agent.yml file outputs: default: type: kafka hosts: \["192.168.x.x:9092"\] topic: netflow-test partition.round\_robin: reachable\_only: false required\_acks: 1 compression:… --- ## [\[Integrations\] Centreon logs integration](https://discuss.elastic.co/t/integrations-centreon-logs-integration/374329)
**Author:** [@marrc.rousseau](https://discuss.elastic.co/u/marrc.rousseau)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 5:22pm UTC](https://discuss.elastic.co/t/integrations-centreon-logs-integration/374329 "2025-02-10T17:22:11Z")
Hello, I made a post on Centreon forum to ingest all centreon logs: -audit logs (Administration Logs) -event logs (Monitoring \> Event Logs \> Event Logs) -system logs (Monitoring \> Event Logs \> System Logs) I hope… --- ## [Does elastic agent store logs if elasticsearch go down for some time](https://discuss.elastic.co/t/does-elastic-agent-store-logs-if-elasticsearch-go-down-for-some-time/374354)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 3\ **Last updated:** [February 12, 2025, 5:38am UTC](https://discuss.elastic.co/t/does-elastic-agent-store-logs-if-elasticsearch-go-down-for-some-time/374354 "2025-02-12T05:38:18Z")
I want to confirm it , logs temporarily saved in a file when Elasticsearch go down due to some issue and when elasticsearch is UP , it is automatically send stored logs to elasticsearch? It is the feature in elasticagent … --- ## [Local MySQL DB](https://discuss.elastic.co/t/local-mysql-db/374217)
**Author:** [@joerg\_kraemer1](https://discuss.elastic.co/u/joerg_kraemer1)\ **Replies:** 2\ **Last updated:** [February 11, 2025, 8:30am UTC](https://discuss.elastic.co/t/local-mysql-db/374217 "2025-02-11T08:30:10Z")
How can I use the Elastic Agent in my case? We have a Local MySQL DB on all of our clients. In that DB is a errorlog. How can I get that into Elastic? Shoves in the right direction would be nice :slight\_smile: --- ## [Fleet output cloning](https://discuss.elastic.co/t/fleet-output-cloning/374349)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 0\ **Last updated:** [February 11, 2025, 7:09am UTC](https://discuss.elastic.co/t/fleet-output-cloning/374349 "2025-02-11T07:09:11Z")
We are using Elastic Agent with Fleet and our output is Kafka. That's why we need to create separate output configuration for each client. There are quite many things to configure. Is it possible to clone existing output… --- ## [Monitor Agent-Status](https://discuss.elastic.co/t/monitor-agent-status/374059)
**Author:** [@MGBSLC](https://discuss.elastic.co/u/MGBSLC)\ **Replies:** 1\ **Last updated:** [February 10, 2025, 7:34pm UTC](https://discuss.elastic.co/t/monitor-agent-status/374059 "2025-02-10T19:34:22Z")
Hi Community We would like to monitor the agent-status (status = unhealthy) of an elastic agent but only with a specific integration policy included. what would be the best way to create such a monitor in Kibana? --- ## [Filebeat and metricbeat logs ending up in /var/log/messages](https://discuss.elastic.co/t/filebeat-and-metricbeat-logs-ending-up-in-var-log-messages/374134)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 1\ **Last updated:** [February 10, 2025, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-and-metricbeat-logs-ending-up-in-var-log-messages/374134 "2025-02-10T18:53:39Z")
I am seeing that metricbeat/filebeat running on Linux are logging their messages to /var/log/messages instead of file. Here is my configuration: logging.level: info logging.to\_syslog: false logging.to\_files: true loggi… --- ## [Limited to Initial 1000 Logs from API with Elastic Agent](https://discuss.elastic.co/t/limited-to-initial-1000-logs-from-api-with-elastic-agent/374224)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 4\ **Last updated:** [February 10, 2025, 2:50pm UTC](https://discuss.elastic.co/t/limited-to-initial-1000-logs-from-api-with-elastic-agent/374224 "2025-02-10T14:50:42Z")
Hi All, We have configured our elastic-agent.yml to poll logs every 1 minute. However, the API returns a maximum of 1000 logs per poll, so we’re only receiving the first 1000 logs while the remaining logs are not being … --- ## [Source.ip not available in the logs received from windows](https://discuss.elastic.co/t/source-ip-not-available-in-the-logs-received-from-windows/374308)
**Author:** [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 12:38pm UTC](https://discuss.elastic.co/t/source-ip-not-available-in-the-logs-received-from-windows/374308 "2025-02-10T12:38:13Z")
I have integrated Windows computer and receiving logs using elastic agent. For several security rules source.ip field is required for detection. Instead of source.ip the logs are indexed with host.ip. how do i change it… --- ## [Azure Integration - incomplete logs in standard dashboards](https://discuss.elastic.co/t/azure-integration-incomplete-logs-in-standard-dashboards/374303)
**Author:** [@Simon7](https://discuss.elastic.co/u/Simon7)\ **Replies:** 0\ **Last updated:** [February 10, 2025, 10:39am UTC](https://discuss.elastic.co/t/azure-integration-incomplete-logs-in-standard-dashboards/374303 "2025-02-10T10:39:07Z")
Hi, i´m in trouble with the azure integrations in elastic. I use an elastic-agent of an own linux server to collect logs out of an azure eventhub. In discover i see any logs with the following data\_stream.dataset: azure… --- ## [Wrong data for field iis.application\_pool.process.cpu\_usage\_perc](https://discuss.elastic.co/t/wrong-data-for-field-iis-application-pool-process-cpu-usage-perc/373004)
**Author:** [@cagostinelli](https://discuss.elastic.co/u/cagostinelli)\ **Replies:** 1\ **Last updated:** [February 6, 2025, 12:18pm UTC](https://discuss.elastic.co/t/wrong-data-for-field-iis-application-pool-process-cpu-usage-perc/373004 "2025-02-06T12:18:46Z")
Hi Team, We see wrong data for The CPU usage percentage from the field iis.application\_pool.process.cpu\_usage\_perc images: Can you help me on this? --- ## [Crowdstrike REST API via Elastic Agent 400 error](https://discuss.elastic.co/t/crowdstrike-rest-api-via-elastic-agent-400-error/360084)
**Author:** [@MrImagine](https://discuss.elastic.co/u/MrImagine)\ **Replies:** 2\ **Last updated:** [February 5, 2025, 1:56pm UTC](https://discuss.elastic.co/t/crowdstrike-rest-api-via-elastic-agent-400-error/360084 "2025-02-05T13:56:55Z")
Hi all, I have an ELK stack running with fleet installed. In our fleet is an elastic agent configured. The current verions are: -Elasticsearch 8.13.2 -Fleet and Agent verions: 8.13.4 -Crowdstrike Integration: 1.34.… --- ## [Migrate agent policies to a new fleet server](https://discuss.elastic.co/t/migrate-agent-policies-to-a-new-fleet-server/373994)
**Author:** [@Dth\_Revan](https://discuss.elastic.co/u/Dth_Revan)\ **Replies:** 1\ **Last updated:** [February 3, 2025, 1:25pm UTC](https://discuss.elastic.co/t/migrate-agent-policies-to-a-new-fleet-server/373994 "2025-02-03T13:25:49Z")
Hello everyone! i have a test cluster with fleet server where there is an elastic agent with synthetics (heartbeat) policy. as this is a test cluster i decided to make a single policy "fleet+heartbeat policy" and assign … --- ## [Palo Alto Cortex XDR Update](https://discuss.elastic.co/t/palo-alto-cortex-xdr-update/373968)
**Author:** [@x\_deee](https://discuss.elastic.co/u/x_deee)\ **Replies:** 8\ **Last updated:** [February 3, 2025, 4:50am UTC](https://discuss.elastic.co/t/palo-alto-cortex-xdr-update/373968 "2025-02-03T04:50:30Z")
Recently, Cortex XDR by Palo Alto updated their api endpoint URLs from v1 to v2. This small change prevents data from entering our Elasticstack. So far, I have attempted to change elastic-agent.yml and change the httpjso… --- ## [How to get host.name reporting uniformity?](https://discuss.elastic.co/t/how-to-get-host-name-reporting-uniformity/373953)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 1\ **Last updated:** [January 31, 2025, 5:50pm UTC](https://discuss.elastic.co/t/how-to-get-host-name-reporting-uniformity/373953 "2025-01-31T17:50:34Z")
We see a lot of variation in how different fleet agent integrations report the hostname. Although we have configured our agent policies to report the FQDN. Some integrations still just report the hostname instead of the … --- ## [How can I trigger an email alert that includes all alerts, instead of sending each alert live? Urgent! Please help](https://discuss.elastic.co/t/how-can-i-trigger-an-email-alert-that-includes-all-alerts-instead-of-sending-each-alert-live-urgent-please-help/373943)
**Author:** [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Replies:** 1\ **Last updated:** [January 31, 2025, 4:02pm UTC](https://discuss.elastic.co/t/how-can-i-trigger-an-email-alert-that-includes-all-alerts-instead-of-sending-each-alert-live-urgent-please-help/373943 "2025-01-31T16:02:01Z")
Hello team, I have installed Elastalert2 and configured it with elk i want to trigger an email alert that includes all alerts, instead of sending each alert live? Like custom rule anything? How can i do that please he… --- ## [Is it possible to run Fleet & Elastic Agent locally?](https://discuss.elastic.co/t/is-it-possible-to-run-fleet-elastic-agent-locally/360502)
**Author:** [@ffamous](https://discuss.elastic.co/u/ffamous)\ **Replies:** 2\ **Last updated:** [January 31, 2025, 3:08pm UTC](https://discuss.elastic.co/t/is-it-possible-to-run-fleet-elastic-agent-locally/360502 "2025-01-31T15:08:17Z")
Hello. I run Kibana and Elasticsearch in docker and trying to configurate Fleet with Elastic agent on the same system just for test/learning purpose, but cannot figure it out how to do that. Is it even possible to config… --- ## [Providing agent ip to the proxy](https://discuss.elastic.co/t/providing-agent-ip-to-the-proxy/373896)
**Author:** [@atnestors](https://discuss.elastic.co/u/atnestors)\ **Replies:** 0\ **Last updated:** [January 30, 2025, 2:14pm UTC](https://discuss.elastic.co/t/providing-agent-ip-to-the-proxy/373896 "2025-01-30T14:14:30Z")
Hello, I have a reverse proxy running Flask that needs to check and log the ip of an agent before allowing the connection. Is there a way to make Elastic send the target agent ip along with the CONNECT request? I've see… --- ## [Multiple unmapped / unknow Elastic Agent log fields](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [January 28, 2025, 7:54pm UTC](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653 "2025-01-28T19:54:45Z")
Hello, I noticed a lot of Elastic Agent log fields have a question mark and seem unmapped. Imho it would be useful if we can aggregate on these fields. Could the mapping please be updated so these fields can be used pro… --- ## [Elastic Agent vs System integration](https://discuss.elastic.co/t/elastic-agent-vs-system-integration/373771)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 1\ **Last updated:** [January 28, 2025, 2:31pm UTC](https://discuss.elastic.co/t/elastic-agent-vs-system-integration/373771 "2025-01-28T14:31:37Z")
In my ELK stack deployment I have for most agent policies the System integration set with the "Collect metrics from System instances" enabled as can be seen below: Recently I saw that there is a setting to enable log… --- ## [Elastic Agent output to Azure Event Hub](https://discuss.elastic.co/t/elastic-agent-output-to-azure-event-hub/373752)
**Author:** [@linuschewpet](https://discuss.elastic.co/u/linuschewpet)\ **Replies:** 0\ **Last updated:** [January 28, 2025, 3:36am UTC](https://discuss.elastic.co/t/elastic-agent-output-to-azure-event-hub/373752 "2025-01-28T03:36:37Z")
Recently I have seen a post on Elastic Agent new output to kafka Would the output be doable with Azure Event Hub since its technically kafka as well. --- ## [Elastic-agent-complete:\>=8.16.0 chowns NSSDB](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 3\ **Last updated:** [January 27, 2025, 8:35pm UTC](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556 "2025-01-27T20:35:12Z")
I am having an issue with elastic-agent-complete:8.16.1. We use self-signed certs on many of the internal sites we monitor, so I have to add these certs to the nssdb, however they need to be chown'd to elastic-agent:ela… --- ## [How to send the cloud watch logs into elastic search](https://discuss.elastic.co/t/how-to-send-the-cloud-watch-logs-into-elastic-search/372829)
**Author:** [@sandraimmaculate](https://discuss.elastic.co/u/sandraimmaculate)\ **Replies:** 2\ **Last updated:** [January 27, 2025, 8:23am UTC](https://discuss.elastic.co/t/how-to-send-the-cloud-watch-logs-into-elastic-search/372829 "2025-01-27T08:23:46Z")
Hello, I want to send the AWS VPC flow logs to elaticsearch using aws vpc flow log integration my vpc flow logs are in cloud watch. So i have added the access key secret key and log group arn in cloud watch session. and… --- ## [Add custom field via Fleet](https://discuss.elastic.co/t/add-custom-field-via-fleet/373681)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 0\ **Last updated:** [January 26, 2025, 2:11pm UTC](https://discuss.elastic.co/t/add-custom-field-via-fleet/373681 "2025-01-26T14:11:11Z")
Hello everyone, I am using Elastic Agents and managing them through the Fleet server. I usually add an ID to every document collected by the agent using the following option: - add\_id: target\_field: "event.id" Can … --- ## [Tenable sc integration "write error: write length 1055365 exceeds maximum file size 104857"](https://discuss.elastic.co/t/tenable-sc-integration-write-error-write-length-1055365-exceeds-maximum-file-size-104857/371383)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 4\ **Last updated:** [January 24, 2025, 7:47pm UTC](https://discuss.elastic.co/t/tenable-sc-integration-write-error-write-length-1055365-exceeds-maximum-file-size-104857/371383 "2025-01-24T19:47:19Z")
Hello to all, After configuring the integration I started to notice that the logs were not arriving steadily but with intervals of 3 to 12 hours which was strange to me. When reviewing the log presented by the agent… --- ## [Elastic APM cloud allowing request from a dev env localhost](https://discuss.elastic.co/t/elastic-apm-cloud-allowing-request-from-a-dev-env-localhost/373536)
**Author:** [@Andre\_Pereira1](https://discuss.elastic.co/u/Andre_Pereira1)\ **Replies:** 5\ **Last updated:** [January 24, 2025, 2:44pm UTC](https://discuss.elastic.co/t/elastic-apm-cloud-allowing-request-from-a-dev-env-localhost/373536 "2025-01-24T14:44:32Z")
I'm using elastic cloud. I am requesting assistance enabling Cross-Origin Resource Sharing (CORS) for http://localhost:8080 on our APM server. how can I configure the APM server to allow requests from a test localhost … [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=9) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=11)