# Elastic Agent

**URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=19

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 20

---

## [Fleet server on-prem resource requirements](https://discuss.elastic.co/t/fleet-server-on-prem-resource-requirements/361997)

<div class="topic-metadata">

**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\
**Replies:** 0\
**Last updated:** [June 25, 2024, 7:41am UTC](https://discuss.elastic.co/t/fleet-server-on-prem-resource-requirements/361997 "2024-06-25T07:41:12Z")

</div>

Hi, I am setting up a Fleet Server on-premises and need guidance on resource allocation. The Elastic Cloud documentation provides the following resource requirements based on the number of agents: Number of Agents F…

---

## [Filestream exclude\_lines doesn't appear to be working](https://discuss.elastic.co/t/filestream-exclude-lines-doesnt-appear-to-be-working/361759)

<div class="topic-metadata">

**Author:** [@Steve\_Foster](https://discuss.elastic.co/u/Steve_Foster)\
**Replies:** 8\
**Last updated:** [June 24, 2024, 9:41pm UTC](https://discuss.elastic.co/t/filestream-exclude-lines-doesnt-appear-to-be-working/361759 "2024-06-24T21:41:29Z")

</div>

I'm trying to stop the inclusion of healthcheck log lines from being sent to Elasticsearch. In the filestream docs there is the exclude\_lines option which is an array of regex. So if I want to filter out lines that con…

---

## [Elastic APM WebSphere Servant differentiation](https://discuss.elastic.co/t/elastic-apm-websphere-servant-differentiation/361973)

<div class="topic-metadata">

**Author:** [@AP\_12](https://discuss.elastic.co/u/AP_12)\
**Replies:** 0\
**Last updated:** [June 24, 2024, 2:57pm UTC](https://discuss.elastic.co/t/elastic-apm-websphere-servant-differentiation/361973 "2024-06-24T14:57:24Z")

</div>

So we have Elastic Agent installed on our JVM but when we spin up multiple Servant servers which are essentially clones of the JVM where the agent is installed. So these clones also have the same logical name so whether …

---

## [DNS processor does not work with Suricata integration](https://discuss.elastic.co/t/dns-processor-does-not-work-with-suricata-integration/361961)

<div class="topic-metadata">

**Author:** [@svatopluk](https://discuss.elastic.co/u/svatopluk)\
**Replies:** 0\
**Last updated:** [June 24, 2024, 12:54pm UTC](https://discuss.elastic.co/t/dns-processor-does-not-work-with-suricata-integration/361961 "2024-06-24T12:54:17Z")

</div>

Hello community, I have a problem with dns processor. I am using Suricata integration and I need DNS reverse lookup, that's why I decided to use dns processor. I also created mapping for new fields. But this processor d…

---

## [Elastic Agent TCP Input - Proxy Protocol](https://discuss.elastic.co/t/elastic-agent-tcp-input-proxy-protocol/361789)

<div class="topic-metadata">

**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\
**Replies:** 1\
**Last updated:** [June 21, 2024, 8:32am UTC](https://discuss.elastic.co/t/elastic-agent-tcp-input-proxy-protocol/361789 "2024-06-21T08:32:06Z")

</div>

We're trying to configure load balancing for certain integrations that listen on a specific TCP port for incoming traffic, for example Cisco FTD. The LB is Nginx and it's load balancing on L4 (stream module). Here's the…

---

## [How to manage configuration of elastic agents on remote machines?](https://discuss.elastic.co/t/how-to-manage-configuration-of-elastic-agents-on-remote-machines/361787)

<div class="topic-metadata">

**Author:** [@elk1985](https://discuss.elastic.co/u/elk1985)\
**Replies:** 1\
**Last updated:** [June 20, 2024, 12:29pm UTC](https://discuss.elastic.co/t/how-to-manage-configuration-of-elastic-agents-on-remote-machines/361787 "2024-06-20T12:29:08Z")

</div>

Hi. I have two problems to solve: 1.How to manage configuration of elastic agents / filebeat config files on remote machines ? I want to have one centralized place so I can update remotely the Filebeat configuration. …

---

## [Delay in ingestion of nginx ingress controller logs](https://discuss.elastic.co/t/delay-in-ingestion-of-nginx-ingress-controller-logs/361692)

<div class="topic-metadata">

**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\
**Replies:** 2\
**Last updated:** [June 20, 2024, 8:47am UTC](https://discuss.elastic.co/t/delay-in-ingestion-of-nginx-ingress-controller-logs/361692 "2024-06-20T08:47:52Z")

</div>

Hi sir, we have enabled the nginx ingress controller integration for our kubernetes environment but the ingestion/indexing rate of the nginx ingress controller access logs are very slow when compared with other kubernet…

---

## [Linux Agent failing to get local metrics with certificate authority error](https://discuss.elastic.co/t/linux-agent-failing-to-get-local-metrics-with-certificate-authority-error/361693)

<div class="topic-metadata">

**Author:** [@Ross\_Wakelin](https://discuss.elastic.co/u/Ross_Wakelin)\
**Replies:** 0\
**Last updated:** [June 19, 2024, 5:25am UTC](https://discuss.elastic.co/t/linux-agent-failing-to-get-local-metrics-with-certificate-authority-error/361693 "2024-06-19T05:25:23Z")

</div>

We are rebuilding our cluster using 8.14.1, and decided to change our configuration to match the latest and greatest. We have fleet servers and agents, and all our certificates are generated using our in-house CA - we D…

---

## [Fleet Agents and Directing Data to Cluster](https://discuss.elastic.co/t/fleet-agents-and-directing-data-to-cluster/361689)

<div class="topic-metadata">

**Author:** [@digital-thought](https://discuss.elastic.co/u/digital-thought)\
**Replies:** 0\
**Last updated:** [June 19, 2024, 3:11am UTC](https://discuss.elastic.co/t/fleet-agents-and-directing-data-to-cluster/361689 "2024-06-19T03:11:01Z")

</div>

We are looking to deploy the Elastic Agent to a large number of devices. The idea would be that they would all use the same Policy. The Policy also controls the default HOT node to which data and agent telemetry is dir…

---

## [Qualys integration error](https://discuss.elastic.co/t/qualys-integration-error/361461)

<div class="topic-metadata">

**Author:** [@Eljafopregunta](https://discuss.elastic.co/u/Eljafopregunta)\
**Replies:** 3\
**Last updated:** [June 18, 2024, 6:39am UTC](https://discuss.elastic.co/t/qualys-integration-error/361461 "2024-06-18T06:39:26Z")

</div>

Hello, Yesterday, I updated the Qualys integration, and now the integration has stopped working. I tried to read the request to the Qualys API in the "configs" tab of the integration, but it only shows this error: I…

---

## [Problem install \\\\.\\pipe\\elastic-agent-system not found](https://discuss.elastic.co/t/problem-install-pipe-elastic-agent-system-not-found/361541)

<div class="topic-metadata">

**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\
**Replies:** 0\
**Last updated:** [June 16, 2024, 9:15am UTC](https://discuss.elastic.co/t/problem-install-pipe-elastic-agent-system-not-found/361541 "2024-06-16T09:15:03Z")

</div>

hello, i want to report about install problems on windows server. The install failed until i removed "Windows Syubsystem for linux" from the computer. Guess the setup mixed up environments. The error message was: d…

---

## [Elastic endpoint isn't installed after adding Elastic Defend integration](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450)

<div class="topic-metadata">

**Author:** [@OoO](https://discuss.elastic.co/u/OoO)\
**Replies:** 16\
**Last updated:** [June 14, 2024, 8:11am UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450 "2024-06-14T08:11:19Z")

</div>

Hello world, I have a problem when testing Elastic Security with "Current plan:Basic". OS Version: Ubuntu 20.04 for Elastic Agent and Elasticsearch-Kibana-Fleet serve Elastic Stack Version: 8.13.4 I am using the super…

---

## [Create an alias for Fleet Agents](https://discuss.elastic.co/t/create-an-alias-for-fleet-agents/361302)

<div class="topic-metadata">

**Author:** [@otortosa](https://discuss.elastic.co/u/otortosa)\
**Replies:** 3\
**Last updated:** [June 14, 2024, 4:07am UTC](https://discuss.elastic.co/t/create-an-alias-for-fleet-agents/361302 "2024-06-14T04:07:57Z")

</div>

Hello! In my system have several hosts that their hostname is a generic one, cannot be change due production affectation. My question is, can it be to add an alias for a Fleet Agent? For example. DESKTOP-RJGJEAFKG and…

---

## [Upgrade issue on linux like os (kali, proxmox)](https://discuss.elastic.co/t/upgrade-issue-on-linux-like-os-kali-proxmox/359074)

<div class="topic-metadata">

**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\
**Replies:** 2\
**Last updated:** [June 13, 2024, 6:01am UTC](https://discuss.elastic.co/t/upgrade-issue-on-linux-like-os-kali-proxmox/359074 "2024-06-13T06:01:22Z")

</div>

i am currently updating my agents to 8.13.1 via fleet. The upgrade is failing on linux machines while my windows were updated like expected. The error is elastic-agent upgrade 8.13.1 Error: Failed trigger upgrade of d…

---

## [Unable to install Elastic APM](https://discuss.elastic.co/t/unable-to-install-elastic-apm/358834)

<div class="topic-metadata">

**Author:** [@NNNNNNNNN](https://discuss.elastic.co/u/NNNNNNNNN)\
**Replies:** 1\
**Last updated:** [June 13, 2024, 2:43am UTC](https://discuss.elastic.co/t/unable-to-install-elastic-apm/358834 "2024-06-13T02:43:58Z")

</div>

Hello, I am trying to install elastic with default token which has shown as part of elastic APM installation. I have ran below query: in elastic observability lab the elastic pswd: JcRZwmwBPduguAu Command: curl -L -O…

---

## [TLS1.1 disable in Fleet Server](https://discuss.elastic.co/t/tls1-1-disable-in-fleet-server/361245)

<div class="topic-metadata">

**Author:** [@Thorsten\_82](https://discuss.elastic.co/u/Thorsten_82)\
**Replies:** 2\
**Last updated:** [June 12, 2024, 6:30am UTC](https://discuss.elastic.co/t/tls1-1-disable-in-fleet-server/361245 "2024-06-12T06:30:44Z")

</div>

Hello, I want do disable TLS1.1 support in Elastic Agent (Fleet Server). In Custom fleet-server configurations I tried to set the "ssl.supported\_protocols: \[TLSv1.2\]" but with no effect. With "elastic-agent inspect" I…

---

## [Java APM not sending events from kubernetes to Elastic Server](https://discuss.elastic.co/t/java-apm-not-sending-events-from-kubernetes-to-elastic-server/361110)

<div class="topic-metadata">

**Author:** [@ansuman04](https://discuss.elastic.co/u/ansuman04)\
**Replies:** 2\
**Last updated:** [June 11, 2024, 8:35am UTC](https://discuss.elastic.co/t/java-apm-not-sending-events-from-kubernetes-to-elastic-server/361110 "2024-06-11T08:35:58Z")

</div>

My Spring boot service is getting registered. But I am not able to see any metrices under Elastic APM for my Service. agent version is 1.50.0 server version is 8.12.2 micrometer version 1.2.4 Below is my elastic conf…

---

## [What are the actual benefits of Elastic Agent?](https://discuss.elastic.co/t/what-are-the-actual-benefits-of-elastic-agent/360675)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 4\
**Last updated:** [June 10, 2024, 9:49pm UTC](https://discuss.elastic.co/t/what-are-the-actual-benefits-of-elastic-agent/360675 "2024-06-10T21:49:23Z")

</div>

I started writing this as a reply on this issue: Offer a lightweight Elastic Agent · Issue #3364 · elastic/elastic-agent · GitHub, but then it morphed into it's own thing and I decided it would be better off here. I rea…

---

## [Elastic-agent does not send metrics to Logstash](https://discuss.elastic.co/t/elastic-agent-does-not-send-metrics-to-logstash/360824)

<div class="topic-metadata">

**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\
**Replies:** 3\
**Last updated:** [June 9, 2024, 8:12am UTC](https://discuss.elastic.co/t/elastic-agent-does-not-send-metrics-to-logstash/360824 "2024-06-09T08:12:33Z")

</div>

I recently installed a stand-alone Elastic Agent version 8.11.3. I configured the agent to send metrics to the Logstash server and to collect metrics from the server on which it is installed. However, I do not see any d…

---

## [Elastic Agent - Parsing JSON file to fields](https://discuss.elastic.co/t/elastic-agent-parsing-json-file-to-fields/360319)

<div class="topic-metadata">

**Author:** [@idan\_amar](https://discuss.elastic.co/u/idan_amar)\
**Replies:** 1\
**Last updated:** [June 8, 2024, 2:20pm UTC](https://discuss.elastic.co/t/elastic-agent-parsing-json-file-to-fields/360319 "2024-06-08T14:20:13Z")

</div>

hello i use the custom logs for input mtr.json file { "report": { "mtr": { "src": "something.com", "dst": "something.else", "tos": 0, "tests": 10, …

---

## [Elastic agent can not read multi-aggregation metrics from Azure Monitor](https://discuss.elastic.co/t/elastic-agent-can-not-read-multi-aggregation-metrics-from-azure-monitor/360911)

<div class="topic-metadata">

**Author:** [@minhtranes](https://discuss.elastic.co/u/minhtranes)\
**Replies:** 0\
**Last updated:** [June 6, 2024, 4:59am UTC](https://discuss.elastic.co/t/elastic-agent-can-not-read-multi-aggregation-metrics-from-azure-monitor/360911 "2024-06-06T04:59:45Z")

</div>

I am using Elastic Agent to collect Azure Monitor metrics using Azure Resource Metrics Integration My configuration is as bellow: - resource\_query: resourceType eq 'Microsoft.ServiceBus/Namespaces' metrics: - nam…

---

## [Filebeat failed to connect to backoff error](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff-error/360892)

<div class="topic-metadata">

**Author:** [@mealbert23](https://discuss.elastic.co/u/mealbert23)\
**Replies:** 0\
**Last updated:** [June 5, 2024, 10:42pm UTC](https://discuss.elastic.co/t/filebeat-failed-to-connect-to-backoff-error/360892 "2024-06-05T22:42:36Z")

</div>

Hi, I am very new to the world of elastic but have learned a lot via trial and error over the last few weeks. I have setup elastic/kibana on a AWS EKS system. Elasticsearch and kibana reside in a private subnet and ki…

---

## [Fleet Server Intergrations not working on Self Hosted Cluster w/ Self Signed Certs](https://discuss.elastic.co/t/fleet-server-intergrations-not-working-on-self-hosted-cluster-w-self-signed-certs/360889)

<div class="topic-metadata">

**Author:** [@mstark\_mw](https://discuss.elastic.co/u/mstark_mw)\
**Replies:** 2\
**Last updated:** [June 5, 2024, 9:29pm UTC](https://discuss.elastic.co/t/fleet-server-intergrations-not-working-on-self-hosted-cluster-w-self-signed-certs/360889 "2024-06-05T21:29:26Z")

</div>

I set up an elastic stack using elastic 8.12. It was working fine and fleet was working as expected. One my elasticsearch server unfortunately died. There were no back ups... I recreated the entire Elastic, Kibana, and …

---

## [Sysmon for Linux on Standalone Elastic-Agent to Logstash without Kibana](https://discuss.elastic.co/t/sysmon-for-linux-on-standalone-elastic-agent-to-logstash-without-kibana/360748)

<div class="topic-metadata">

**Author:** [@julia.navarro](https://discuss.elastic.co/u/julia.navarro)\
**Replies:** 0\
**Last updated:** [June 3, 2024, 10:39pm UTC](https://discuss.elastic.co/t/sysmon-for-linux-on-standalone-elastic-agent-to-logstash-without-kibana/360748 "2024-06-03T22:39:58Z")

</div>

I'm trying to configure Sysmon for Linux to send data/logs using a Standalone Elastic-Agent to send the data to Logstash, which will then send the data to Elasticsearch. I want to set this up without having to go into Ki…

---

## [Ingesting Nginx access logs in custom log format](https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708)

<div class="topic-metadata">

**Author:** [@sai8274](https://discuss.elastic.co/u/sai8274)\
**Replies:** 2\
**Last updated:** [June 3, 2024, 3:52pm UTC](https://discuss.elastic.co/t/ingesting-nginx-access-logs-in-custom-log-format/360708 "2024-06-03T15:52:04Z")

</div>

Hi All, I had a question in regards to the nginx integration of elastic agent. We are using a custom format for nginx logs that has some additional metrics, so the grok in default ingest policy that comes with nginx in…

---

## [Multiline Parsing- Elastic Agent/Fleet](https://discuss.elastic.co/t/multiline-parsing-elastic-agent-fleet/360580)

<div class="topic-metadata">

**Author:** [@bigmike19](https://discuss.elastic.co/u/bigmike19)\
**Replies:** 1\
**Last updated:** [May 30, 2024, 10:34pm UTC](https://discuss.elastic.co/t/multiline-parsing-elastic-agent-fleet/360580 "2024-05-30T22:34:17Z")

</div>

Hello Everyone, We are new to Elastic. We are using the Elastic Agent and are using Fleet management. We have a number of logs events coming in as separate documents. We are interested in setting up multiline parsing. I…

---

## [Microsoft Entra ID Entity Analytics vs Azure](https://discuss.elastic.co/t/microsoft-entra-id-entity-analytics-vs-azure/360498)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 2\
**Last updated:** [May 30, 2024, 7:40pm UTC](https://discuss.elastic.co/t/microsoft-entra-id-entity-analytics-vs-azure/360498 "2024-05-30T19:40:19Z")

</div>

Hello, I been leveraging Azure Logs - Audit Logs to collect Azure AD data. This is have been alright but I wanted to test out the Microsoft Entra ID Entity Analytics, wondering if others' experience with the latter int…

---

## [Troubleshooting pipeline used in Elastic Agent Agent policy](https://discuss.elastic.co/t/troubleshooting-pipeline-used-in-elastic-agent-agent-policy/360541)

<div class="topic-metadata">

**Author:** [@eenthusiast](https://discuss.elastic.co/u/eenthusiast)\
**Replies:** 0\
**Last updated:** [May 30, 2024, 8:27am UTC](https://discuss.elastic.co/t/troubleshooting-pipeline-used-in-elastic-agent-agent-policy/360541 "2024-05-30T08:27:23Z")

</div>

I have added the Custom Logs integration to a policy active for one Agent. I have added a simple pipeline to this Agent policy using the " Ingest pipelines" setting under "Change defaults". But after adding the Ingest …

---

## [Manage secrets in fleet managed elastic-agents](https://discuss.elastic.co/t/manage-secrets-in-fleet-managed-elastic-agents/358667)

<div class="topic-metadata">

**Author:** [@liquidkite](https://discuss.elastic.co/u/liquidkite)\
**Replies:** 3\
**Last updated:** [May 29, 2024, 1:41pm UTC](https://discuss.elastic.co/t/manage-secrets-in-fleet-managed-elastic-agents/358667 "2024-05-29T13:41:42Z")

</div>

Hello all, We currently use fleet managed elastic-agents to collect logs from a variety of data sources. We would like to store our secrets that we use for agent policies as a kubernetes secret and use the kubernetes\_se…

---

## [Windows Agent reinstall issue](https://discuss.elastic.co/t/windows-agent-reinstall-issue/360462)

<div class="topic-metadata">

**Author:** [@Vladimir7172](https://discuss.elastic.co/u/Vladimir7172)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 12:27pm UTC](https://discuss.elastic.co/t/windows-agent-reinstall-issue/360462 "2024-05-29T12:27:47Z")

</div>

Hello I have a problem with agent on Windows The very first time I deleted it, I received the error "Error: Yaml:Line 6: Didn't Find Expected Key". I didn’t bother to figure it out and decided to delete everything acco…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=18)

[Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=20)
