# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=13 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 14 --- ## [Elastic Agent (Security Onion)](https://discuss.elastic.co/t/elastic-agent-security-onion/370611)
**Author:** [@chamara\_sandun](https://discuss.elastic.co/u/chamara_sandun)\ **Replies:** 11\ **Last updated:** [November 23, 2024, 1:41pm UTC](https://discuss.elastic.co/t/elastic-agent-security-onion/370611 "2024-11-23T13:41:27Z")
I installed Security Onion to enhance my knowledge. I followed the documentation for the setup but faced several issues. After setting it up, my main goal was to get Windows event logs into Security Onion. I installed… --- ## [Mimecast SIEM Backlog](https://discuss.elastic.co/t/mimecast-siem-backlog/370795)
**Author:** [@DiFi](https://discuss.elastic.co/u/DiFi)\ **Replies:** 2\ **Last updated:** [November 22, 2024, 6:22pm UTC](https://discuss.elastic.co/t/mimecast-siem-backlog/370795 "2024-11-22T18:22:50Z")
Hi hoping someone could help point me in the right direction. I just setup the mimecast integration and pulling data in. The problem is with mimecast, and the vast amount of logs it needs to ingest, i am about 7 days b… --- ## [Custom log output to Kafka using Elastic Agent](https://discuss.elastic.co/t/custom-log-output-to-kafka-using-elastic-agent/366031)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 7\ **Last updated:** [November 22, 2024, 12:11pm UTC](https://discuss.elastic.co/t/custom-log-output-to-kafka-using-elastic-agent/366031 "2024-11-22T12:11:16Z")
We have Elasticstack 8.15 in use so that client Filebeat output goes to the Kafka and from there to the Elasticsearch. Filebeat sends different logs to separate Kafka topics. We are using following configuration in "file… --- ## [Elastic Agent Integration - Duo](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 7\ **Last updated:** [November 21, 2024, 7:31pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895 "2024-11-21T19:31:04Z")
I'm trying to use the Duo integration in Elastic Agent. In standalone mode. The issue is that it is not using the last event published time so it is using the default value and re-pulling all Duo events. After much trou… --- ## [Alert when host(server) is down](https://discuss.elastic.co/t/alert-when-host-server-is-down/370688)
**Author:** [@bex](https://discuss.elastic.co/u/bex)\ **Replies:** 4\ **Last updated:** [November 21, 2024, 1:56pm UTC](https://discuss.elastic.co/t/alert-when-host-server-is-down/370688 "2024-11-21T13:56:17Z")
Hello everyone! Could you please tell me if there are any ways to create an alert if some server is down or elastic-agent stopped send logs to the Elastic --- ## [Ingesting whole files](https://discuss.elastic.co/t/ingesting-whole-files/370891)
**Author:** [@Rihards](https://discuss.elastic.co/u/Rihards)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 12:22pm UTC](https://discuss.elastic.co/t/ingesting-whole-files/370891 "2024-11-21T12:22:21Z")
Looking for the best way to ingest whole files. Potentially three outcomes would be of interest: a) Ingest the whole plaintext file as a single-field document. b) Ingest the file as k-v pairs (ini-style file). c) Ing… --- ## [Elastic agent metrics](https://discuss.elastic.co/t/elastic-agent-metrics/370833)
**Author:** [@harshpanchal](https://discuss.elastic.co/u/harshpanchal)\ **Replies:** 3\ **Last updated:** [November 20, 2024, 1:20pm UTC](https://discuss.elastic.co/t/elastic-agent-metrics/370833 "2024-11-20T13:20:05Z")
Does the Elastic Agent, with the system integration enabled, expose system metrics in a way that Prometheus can consume them and then display them in Grafana for monitoring ? --- ## [Elastic Agent - logged-in user and model](https://discuss.elastic.co/t/elastic-agent-logged-in-user-and-model/370689)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 1\ **Last updated:** [November 19, 2024, 8:27am UTC](https://discuss.elastic.co/t/elastic-agent-logged-in-user-and-model/370689 "2024-11-19T08:27:14Z")
Hello, I'm asking here because I couldn't find a definitive answer in the documentation. I am running an Elastic Agent on workstations. Does the agent have the capability to collect the currently logged-in user and the… --- ## [Fleet UI - Runtime Field](https://discuss.elastic.co/t/fleet-ui-runtime-field/370701)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [November 19, 2024, 6:11pm UTC](https://discuss.elastic.co/t/fleet-ui-runtime-field/370701 "2024-11-19T18:11:09Z")
Hello, I am working on my own fleet custom dashboard and noticed that the Status field like "Unhealthy" , "Healthy", "Offline", etc are not added to the .fleet-agents-\* index. Is there any logic or perhaps a runtime fi… --- ## [Error fetching Cgroup controller](https://discuss.elastic.co/t/error-fetching-cgroup-controller/370773)
**Author:** [@TS27](https://discuss.elastic.co/u/TS27)\ **Replies:** 0\ **Last updated:** [November 19, 2024, 3:17pm UTC](https://discuss.elastic.co/t/error-fetching-cgroup-controller/370773 "2024-11-19T15:17:50Z")
I just installed elastic agent (8.14.3) managed by fleet on my kubernetes environment and I get the following error: {"log.level":"error","@timestamp":"2024-11-19T14:50:35.380Z","message":"error determining cgroups vers… --- ## [Elastic installation broken](https://discuss.elastic.co/t/elastic-installation-broken/370760)
**Author:** [@Rom\_Pe](https://discuss.elastic.co/u/Rom_Pe)\ **Replies:** 3\ **Last updated:** [November 19, 2024, 10:57am UTC](https://discuss.elastic.co/t/elastic-installation-broken/370760 "2024-11-19T10:57:03Z")
Hey there, after trying to install the Elastic agent the Powershell gave me this error: I cas see that the archive had been installed but he cannot communicate with the server. What can I do do in order to fix it? --- ## [/tmp filling up with core dumps in Elastic Synthetics](https://discuss.elastic.co/t/tmp-filling-up-with-core-dumps-in-elastic-synthetics/370713)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 0\ **Last updated:** [November 18, 2024, 6:08pm UTC](https://discuss.elastic.co/t/tmp-filling-up-with-core-dumps-in-elastic-synthetics/370713 "2024-11-18T18:08:30Z")
I am using Elastic Agent in our EKS cluster. Today I was notified by the cluster admin that the Synthetics nodes, which currently run elastic-agent-complete:8.15.3 are periodically filling the available disk space on the… --- ## [Check Point integration incompatible with data streams, resulting in version\_conflict\_engine\_exception](https://discuss.elastic.co/t/check-point-integration-incompatible-with-data-streams-resulting-in-version-conflict-engine-exception/361173)
**Author:** [@brynjar](https://discuss.elastic.co/u/brynjar)\ **Replies:** 6\ **Last updated:** [November 18, 2024, 10:16am UTC](https://discuss.elastic.co/t/check-point-integration-incompatible-with-data-streams-resulting-in-version-conflict-engine-exception/361173 "2024-11-18T10:16:52Z")
Hi, Ever since migrating from an in-house developed Check Point integration to the official Check Point integration for Elastic Agent, we've been getting millions of version\_conflict\_engine\_exception errors every day. P… --- ## [Elastic Agent : Rename agent names or add a field to differentiate them](https://discuss.elastic.co/t/elastic-agent-rename-agent-names-or-add-a-field-to-differentiate-them/357491)
**Author:** [@GinkoLucas](https://discuss.elastic.co/u/GinkoLucas)\ **Replies:** 3\ **Last updated:** [November 18, 2024, 8:30am UTC](https://discuss.elastic.co/t/elastic-agent-rename-agent-names-or-add-a-field-to-differentiate-them/357491 "2024-11-18T08:30:25Z")
Hello, I'd like to deploy several agents on client servers, in fleet mode. The problem is that the agent name comes from the host machine name, and these names are often unknown to our teams. Of course, it's impossible … --- ## [Metricbeat SQL Module - Elastic Agent Equivalent?](https://discuss.elastic.co/t/metricbeat-sql-module-elastic-agent-equivalent/370630)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [November 16, 2024, 5:30am UTC](https://discuss.elastic.co/t/metricbeat-sql-module-elastic-agent-equivalent/370630 "2024-11-16T05:30:56Z")
Hello we are in the process of migrating from Beats to Elastic Agent. Is there an equivalent to SQL module from Beats where you can query a database and ingest the data into elasticsearch? --- ## [Metricbeat/Elastic Agent - How to get Filesystem Label](https://discuss.elastic.co/t/metricbeat-elastic-agent-how-to-get-filesystem-label/370615)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [November 15, 2024, 4:25pm UTC](https://discuss.elastic.co/t/metricbeat-elastic-agent-how-to-get-filesystem-label/370615 "2024-11-15T16:25:00Z")
I understand with filesystem metricset you can grab the drive letter or the mount point to be exact. Is there a way to grab the filesystem label like this: --- ## [Error upgrading the selected agent Cannot read existing Message Signing Key pair](https://discuss.elastic.co/t/error-upgrading-the-selected-agent-cannot-read-existing-message-signing-key-pair/370537)
**Author:** [@Arianit](https://discuss.elastic.co/u/Arianit)\ **Replies:** 0\ **Last updated:** [November 14, 2024, 10:09am UTC](https://discuss.elastic.co/t/error-upgrading-the-selected-agent-cannot-read-existing-message-signing-key-pair/370537 "2024-11-14T10:09:52Z")
Hi, When i try to upgrade an Agent it shows us this error: --- ## [Logs are coming in event.original but no message field | Elastic Agent](https://discuss.elastic.co/t/logs-are-coming-in-event-original-but-no-message-field-elastic-agent/370389)
**Author:** [@Abhishek\_Singh3](https://discuss.elastic.co/u/Abhishek_Singh3)\ **Replies:** 2\ **Last updated:** [November 13, 2024, 6:37am UTC](https://discuss.elastic.co/t/logs-are-coming-in-event-original-but-no-message-field-elastic-agent/370389 "2024-11-13T06:37:17Z")
I've configured the standalone Elastic Agent on EC2 instances to send logs to Logstash. And it is working fine. But all the logs are coming in event.original field and there is no message or log field. Because of this … --- ## [How to Remove Pending Tasks in Elastic Agent Activity Log?](https://discuss.elastic.co/t/how-to-remove-pending-tasks-in-elastic-agent-activity-log/370456)
**Author:** [@Bikash\_Kunwar](https://discuss.elastic.co/u/Bikash_Kunwar)\ **Replies:** 0\ **Last updated:** [November 13, 2024, 5:42am UTC](https://discuss.elastic.co/t/how-to-remove-pending-tasks-in-elastic-agent-activity-log/370456 "2024-11-13T05:42:18Z")
move the I need help with managing the Elastic Agent activity log. As shown in the attached image, there are multiple pending tasks, such as reassigning agents, that are still marked as "pending." Could someone plea… --- ## [Fleet Dashboard Not Loading or Taking Too Long to Load](https://discuss.elastic.co/t/fleet-dashboard-not-loading-or-taking-too-long-to-load/366657)
**Author:** [@prabhuteja](https://discuss.elastic.co/u/prabhuteja)\ **Replies:** 26\ **Last updated:** [November 11, 2024, 4:24am UTC](https://discuss.elastic.co/t/fleet-dashboard-not-loading-or-taking-too-long-to-load/366657 "2024-11-11T04:24:15Z")
Hi all, I am experiencing an issue with my Fleet dashboard in Kibana. It is either not loading or taking an extremely long time to load. Here are the details of my setup: Elasticsearch is running on svr15 (Ubuntu) in … --- ## [Filebeat in elastic agent is consuming more RAM in windows](https://discuss.elastic.co/t/filebeat-in-elastic-agent-is-consuming-more-ram-in-windows/370057)
**Author:** [@suhasbhatt101](https://discuss.elastic.co/u/suhasbhatt101)\ **Replies:** 2\ **Last updated:** [November 8, 2024, 9:10am UTC](https://discuss.elastic.co/t/filebeat-in-elastic-agent-is-consuming-more-ram-in-windows/370057 "2024-11-08T09:10:22Z")
I am using elastic agent to collect custom logs from my windows server. Filebeat stream is consuming more than 1GB of RAM, some time it is consuming 3 to 4 GB RAM. When i remove the filebeat configurations from the elas… --- ## [Elastic agent reports "no CA certificate matching the fingerprint"](https://discuss.elastic.co/t/elastic-agent-reports-no-ca-certificate-matching-the-fingerprint/370182)
**Author:** [@mscheepers](https://discuss.elastic.co/u/mscheepers)\ **Replies:** 0\ **Last updated:** [November 7, 2024, 7:08pm UTC](https://discuss.elastic.co/t/elastic-agent-reports-no-ca-certificate-matching-the-fingerprint/370182 "2024-11-07T19:08:37Z")
Hi All, i have a internal CA what has signed the certificates and the CA certificate is known by the clients. All information is also been received by the Elasticsearch and showed in Kibana. So everything is looking goo… --- ## [Enroll standalone elastic-agent to fleet](https://discuss.elastic.co/t/enroll-standalone-elastic-agent-to-fleet/370148)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 0\ **Last updated:** [November 7, 2024, 4:54am UTC](https://discuss.elastic.co/t/enroll-standalone-elastic-agent-to-fleet/370148 "2024-11-07T04:54:13Z")
Is there any ways to enroll an elastic agent( that was installed as standalone agent) to fleet server? --- ## [Error enrolling agent](https://discuss.elastic.co/t/error-enrolling-agent/370135)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 0\ **Last updated:** [November 6, 2024, 3:49pm UTC](https://discuss.elastic.co/t/error-enrolling-agent/370135 "2024-11-06T15:49:26Z")
Hello, me again hehehehe I have a new error when installing an agent, although I found related documentation I would like to please confirm me if I understood the solution if I simply run the following lines Solve the … --- ## [Elastic Agent TLS Metadata](https://discuss.elastic.co/t/elastic-agent-tls-metadata/370133)
**Author:** [@axvfvv79zcx57xv7k](https://discuss.elastic.co/u/axvfvv79zcx57xv7k)\ **Replies:** 0\ **Last updated:** [November 6, 2024, 3:17pm UTC](https://discuss.elastic.co/t/elastic-agent-tls-metadata/370133 "2024-11-06T15:17:14Z")
Hello Elastic Community, I'm currently transitioning from a Logstash-based pipeline to the Elastic Agent for managing our data collection and monitoring. However, I've run into an issue with capturing TLS metadata (such… --- ## [Azure Frontdoor integration](https://discuss.elastic.co/t/azure-frontdoor-integration/370075)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [November 5, 2024, 5:02pm UTC](https://discuss.elastic.co/t/azure-frontdoor-integration/370075 "2024-11-05T17:02:59Z")
Hello everyone, I need to receive logs “Azure Frontdoor” I see that there is an integration that allows to do this but I have no idea what are the values of the fields that are required as I am not the Azure administrat… --- ## [Inventory showing elasticagent name instead of actual cluster instance name](https://discuss.elastic.co/t/inventory-showing-elasticagent-name-instead-of-actual-cluster-instance-name/369987)
**Author:** [@sruthi.sattiraju](https://discuss.elastic.co/u/sruthi.sattiraju)\ **Replies:** 0\ **Last updated:** [November 4, 2024, 8:14am UTC](https://discuss.elastic.co/t/inventory-showing-elasticagent-name-instead-of-actual-cluster-instance-name/369987 "2024-11-04T08:14:08Z")
Hi Team, For the agents installed on Azure Kubernetes, Currently in the inventory list I see elastic agent names listing, I would like to see the actual workernode names listed. I see the host.name has elastic agent na… --- ## [Amazon Data Firehose integration stopped working](https://discuss.elastic.co/t/amazon-data-firehose-integration-stopped-working/369883)
**Author:** [@ppborfig](https://discuss.elastic.co/u/ppborfig)\ **Replies:** 6\ **Last updated:** [November 1, 2024, 4:06pm UTC](https://discuss.elastic.co/t/amazon-data-firehose-integration-stopped-working/369883 "2024-11-01T16:06:36Z")
The Amazon Data Firehose integration recently stopped working in all our Elastic Cloud environments. No configuration changes were made in AWS and Elastic. Firehose shows no errors and all deliveries are successful. R… --- ## [Migrate Fleet Agents From Onprem Cluster to Another](https://discuss.elastic.co/t/migrate-fleet-agents-from-onprem-cluster-to-another/369907)
**Author:** [@rz1027](https://discuss.elastic.co/u/rz1027)\ **Replies:** 1\ **Last updated:** [November 1, 2024, 1:15pm UTC](https://discuss.elastic.co/t/migrate-fleet-agents-from-onprem-cluster-to-another/369907 "2024-11-01T13:15:45Z")
Hello, I have a cluster with a setup Elasticfleet with several agents, and I am planning to migrate the cluster to another one. I also have the basic license. Is there a method to migrate the agents to the other cluste… --- ## [Logstash: Could not locate field: logstash.host.name](https://discuss.elastic.co/t/logstash-could-not-locate-field-logstash-host-name/365884)
**Author:** [@Kaustub\_Gupta](https://discuss.elastic.co/u/Kaustub_Gupta)\ **Replies:** 2\ **Last updated:** [October 29, 2024, 12:03pm UTC](https://discuss.elastic.co/t/logstash-could-not-locate-field-logstash-host-name/365884 "2024-10-29T12:03:16Z")
I installed elastic-agent as a service to monitor my server, I then enrolled it with agent policy with various integration, my aim is to use the logstash integration to monitor the logs, in my system logstash is running … [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=12) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=14)