# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=2 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 3 --- ## [Tenable Security Center Integration API Issues](https://discuss.elastic.co/t/tenable-security-center-integration-api-issues/385400)
**Author:** [@AnakinWasRight](https://discuss.elastic.co/u/AnakinWasRight)\ **Replies:** 0\ **Last updated:** [March 11, 2026, 12:14am UTC](https://discuss.elastic.co/t/tenable-security-center-integration-api-issues/385400 "2026-03-11T00:14:09Z")
Self signed cert for Sec Center. The ssl side of the house seems to be fine as the agent is fully healthy. Generated the access/secret key in sec center with an administration account and enabled allow api keys in the gu… --- ## [OpenTelemetry Integration on AirGapped Environment](https://discuss.elastic.co/t/opentelemetry-integration-on-airgapped-environment/385042)
**Author:** [@gbschenkel](https://discuss.elastic.co/u/gbschenkel)\ **Replies:** 4\ **Last updated:** [March 6, 2026, 2:11pm UTC](https://discuss.elastic.co/t/opentelemetry-integration-on-airgapped-environment/385042 "2026-03-06T14:11:27Z")
Hi, we have two ELK clusters, one for production and other for monitoring. The cluster don’t have access to internet, so is an AirGapped environment, the Elastic Artifacts are being rerouted using Sonatype Nexus Reposit… --- ## [\[elastic-agent\]\[beats\] Problem when running as a non-root randomized UID](https://discuss.elastic.co/t/elastic-agent-beats-problem-when-running-as-a-non-root-randomized-uid/385353)
**Author:** [@AlexBaranowski](https://discuss.elastic.co/u/AlexBaranowski)\ **Replies:** 0\ **Last updated:** [March 5, 2026, 3:38pm UTC](https://discuss.elastic.co/t/elastic-agent-beats-problem-when-running-as-a-non-root-randomized-uid/385353 "2026-03-05T15:38:18Z")
The OpenShift environment has a security policy that requires containers to run with a randomized UID. This causes issues when running the Elastic Agent. Typically, a standard solution is to ensure the user belongs to gr… --- ## [Reading Auth Logs on Mac devices](https://discuss.elastic.co/t/reading-auth-logs-on-mac-devices/385269)
**Author:** [@HaydenB0101](https://discuss.elastic.co/u/HaydenB0101)\ **Replies:** 0\ **Last updated:** [February 27, 2026, 5:19pm UTC](https://discuss.elastic.co/t/reading-auth-logs-on-mac-devices/385269 "2026-02-27T17:19:30Z")
I want to get auth. logs from my mac devices and am struggling to find a working integration to use. I have been using the Custom macOS Unified Logs integration to try and get this data from the devices since it’s the o… --- ## [Elastic Agent on Mac in failed state](https://discuss.elastic.co/t/elastic-agent-on-mac-in-failed-state/385255)
**Author:** [@HaydenB0101](https://discuss.elastic.co/u/HaydenB0101)\ **Replies:** 1\ **Last updated:** [February 26, 2026, 6:17pm UTC](https://discuss.elastic.co/t/elastic-agent-on-mac-in-failed-state/385255 "2026-02-26T18:17:22Z")
Hello, I am using the Custom macOS Unified Logs integration with elastic 8.18.8 in order to get logs from my mac device, and I getting errors from the agent elastic-agent status fleet status: (HEALTHY) Connected elas… --- ## [VMware Vsphere Integration - Tags](https://discuss.elastic.co/t/vmware-vsphere-integration-tags/385193)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [February 24, 2026, 9:17pm UTC](https://discuss.elastic.co/t/vmware-vsphere-integration-tags/385193 "2026-02-24T21:17:05Z")
Hello, has anyone using VMware vSphere integration gotten tags from VMs? It seems like NewRelic can grab custom tags from vSphere: https://docs.newrelic.com/install/vsphere/ Background: Many admins use custom tags on V… --- ## [Fleet isn't loading](https://discuss.elastic.co/t/fleet-isnt-loading/384946)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 2\ **Last updated:** [February 19, 2026, 2:59pm UTC](https://discuss.elastic.co/t/fleet-isnt-loading/384946 "2026-02-19T14:59:34Z")
Fleet takes too much time to load It worked when we opened the internet access to the machine, so we have made a firewall rule to go to elastic.co However, the problem still resides What should I look for or how… --- ## [\`agent.logging.to\_eventlog: true\` fails with "appName cannot be empty" even when running as Windows service](https://discuss.elastic.co/t/agent-logging-to-eventlog-true-fails-with-appname-cannot-be-empty-even-when-running-as-windows-service/385096)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 0\ **Last updated:** [February 18, 2026, 12:39pm UTC](https://discuss.elastic.co/t/agent-logging-to-eventlog-true-fails-with-appname-cannot-be-empty-even-when-running-as-windows-service/385096 "2026-02-18T12:39:48Z")
Environment: Elastic Agent: 9.1.10 (build: 45f734) OS: Windows Server 2022 Mode: Standalone (no Fleet) Problem: Setting agent.logging.to\_eventlog: true in elastic-agent.yml causes agent to fail on startup with: elas… --- ## [Need to ingest a smaller logs using Custom Logs (Filestream) integration](https://discuss.elastic.co/t/need-to-ingest-a-smaller-logs-using-custom-logs-filestream-integration/384975)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 0\ **Last updated:** [February 9, 2026, 10:15am UTC](https://discuss.elastic.co/t/need-to-ingest-a-smaller-logs-using-custom-logs-filestream-integration/384975 "2026-02-09T10:15:39Z")
Hi, I encounter the issue about the log ingestion. Currently, I have a cluster with the less of microservices and logs and I need to ingest all of that logs to the Kibana. I have use the Elastic Agent with the Custom … --- ## [Best approach to monitor a Linux Service with the Elastic Agent?](https://discuss.elastic.co/t/best-approach-to-monitor-a-linux-service-with-the-elastic-agent/384916)
**Author:** [@fer.mt](https://discuss.elastic.co/u/fer.mt)\ **Replies:** 4\ **Last updated:** [February 6, 2026, 5:27pm UTC](https://discuss.elastic.co/t/best-approach-to-monitor-a-linux-service-with-the-elastic-agent/384916 "2026-02-06T17:27:12Z")
Hello! I have a software that is critical for us so we want to monitor its availability. We want to start by monitoring the process/service that it creates when running. The software runs on Linux systems. Currently, I … --- ## [Palo Alto logs not being Ingested](https://discuss.elastic.co/t/palo-alto-logs-not-being-ingested/384882)
**Author:** [@diego.roldan](https://discuss.elastic.co/u/diego.roldan)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 12:02pm UTC](https://discuss.elastic.co/t/palo-alto-logs-not-being-ingested/384882 "2026-02-03T12:02:00Z")
Hi, I’m using Elastic Serverless and trying to ingest Palo Alto Next-Gen Firewall logs using the official Palo Alto integration. The issue appears when using an Elastic Agent on Rocky Linux. The integration is configur… --- ## [Ingestion pipeline: setting @timestamp](https://discuss.elastic.co/t/ingestion-pipeline-setting-timestamp/384804)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 3\ **Last updated:** [January 30, 2026, 4:30pm UTC](https://discuss.elastic.co/t/ingestion-pipeline-setting-timestamp/384804 "2026-01-30T16:30:20Z")
Hi, I'd like to set the @timestamp field to the value of event.ingested. It doesn't seem to be possible. My ingestion pipeline: { "processors": \[ { "set": { "ignore\_empty\_value": true, "fiel… --- ## [EDOT running in Gateway mode - "sending queue is full"](https://discuss.elastic.co/t/edot-running-in-gateway-mode-sending-queue-is-full/384639)
**Author:** [@kazagz](https://discuss.elastic.co/u/kazagz)\ **Replies:** 1\ **Last updated:** [January 27, 2026, 7:32am UTC](https://discuss.elastic.co/t/edot-running-in-gateway-mode-sending-queue-is-full/384639 "2026-01-27T07:32:43Z")
When using recommended elastic/elastic-agent image running in OTEL Gateway mode it shows errors when ingesting 10m and 60m aggregated data. Example setup Start Elastic server using elasticsearch/elasticsearch:9.2.3 D… --- ## [Vision One Integration Policy - Agent](https://discuss.elastic.co/t/vision-one-integration-policy-agent/384720)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [January 23, 2026, 5:00pm UTC](https://discuss.elastic.co/t/vision-one-integration-policy-agent/384720 "2026-01-23T17:00:51Z")
Hello everyone, I have a question. I would appreciate it if you could help me and explain it to me, as I am confused. I need the Trend Micro Vision One logs. I have already added the integration. The Vision One admin… --- ## [Elastic Serverless: Agent deployment when using both Observability and Security](https://discuss.elastic.co/t/elastic-serverless-agent-deployment-when-using-both-observability-and-security/384673)
**Author:** [@Abdul\_Haseeb\_Q](https://discuss.elastic.co/u/Abdul_Haseeb_Q)\ **Replies:** 0\ **Last updated:** [January 21, 2026, 1:49pm UTC](https://discuss.elastic.co/t/elastic-serverless-agent-deployment-when-using-both-observability-and-security/384673 "2026-01-21T13:49:49Z")
Hey folks, We currently have Elastic Cloud (managed) deployed, where Observability, Security, and other Elastic features are available within a single deployment. In this setup, we install one Elastic Agent per host, an… --- ## [Error during agent enrollment](https://discuss.elastic.co/t/error-during-agent-enrollment/384246)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 2\ **Last updated:** [January 9, 2026, 3:15pm UTC](https://discuss.elastic.co/t/error-during-agent-enrollment/384246 "2026-01-09T15:15:32Z")
Hello everyone, I am trying to install Elastic Agent version 8.16.2 on Windows servers. On some servers the installation succeeds, but on others it fails with the error: failed to create new agent info: could not get … --- ## [Error when configuring Cloudflare LogPush integration for R2](https://discuss.elastic.co/t/error-when-configuring-cloudflare-logpush-integration-for-r2/380052)
**Author:** [@taprove](https://discuss.elastic.co/u/taprove)\ **Replies:** 4\ **Last updated:** [January 8, 2026, 3:18pm UTC](https://discuss.elastic.co/t/error-when-configuring-cloudflare-logpush-integration-for-r2/380052 "2026-01-08T15:18:54Z")
No matter what configurations I try with the Cloudflare Logpush integration, the following error shows in the log: \[elastic\_agent\]\[error\] Unit state changed aws-s3-default-aws-s3-cloudflare-xxxxxx-xxxx-xxx-xxx-xxxxxxxxx… --- ## [Does 31GB heap limit mean max 2TB disk per hot node with 1:30 ratio?](https://discuss.elastic.co/t/does-31gb-heap-limit-mean-max-2tb-disk-per-hot-node-with-1-30-ratio/384412)
**Author:** [@juan\_ma\_tejada](https://discuss.elastic.co/u/juan_ma_tejada)\ **Replies:** 5\ **Last updated:** [January 8, 2026, 2:47pm UTC](https://discuss.elastic.co/t/does-31gb-heap-limit-mean-max-2tb-disk-per-hot-node-with-1-30-ratio/384412 "2026-01-08T14:47:46Z")
Hi community,I'm confused about applying the 1:30 RAM:disk ratio for hot nodes with the JVM heap limit. My understanding:1:30 ratio means 1 GB RAM per 30 GB disk capacity for hot nodes For 2 TB (2000 GB) disk → need ~6… --- ## [System logs not collected on some Elastic Agent policies](https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426)
**Author:** [@nazok123](https://discuss.elastic.co/u/nazok123)\ **Replies:** 0\ **Last updated:** [January 7, 2026, 6:20pm UTC](https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426 "2026-01-07T18:20:00Z")
Hi everyone, We use Elastic as a SIEM. I have several Elastic Agent policies, and the same agents are assigned to multiple policies. However, on some of the policies, system logs from the sources are not being collecte… --- ## [Can We Temporarily Disable Filestream Integration for a Elastic Agent Policy to temporarily collect data instead of unenroll it?](https://discuss.elastic.co/t/can-we-temporarily-disable-filestream-integration-for-a-elastic-agent-policy-to-temporarily-collect-data-instead-of-unenroll-it/383969)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 4\ **Last updated:** [January 6, 2026, 12:48pm UTC](https://discuss.elastic.co/t/can-we-temporarily-disable-filestream-integration-for-a-elastic-agent-policy-to-temporarily-collect-data-instead-of-unenroll-it/383969 "2026-01-06T12:48:18Z")
Hi all, Currently, my system is collecting log data using Filestream (Custom Logs integration). The thousand agents are managed by policies in the Fleet server. The machines that have the Agents installed usually need … --- ## [Windows host.id not unique](https://discuss.elastic.co/t/windows-host-id-not-unique/373767)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 2\ **Last updated:** [January 5, 2026, 3:15pm UTC](https://discuss.elastic.co/t/windows-host-id-not-unique/373767 "2026-01-05T15:15:01Z")
We are running +300 agents on Windows servers which have been setup using templated/automated installs. We now see that a lot of hosts share the same host.id value in our logging in Elastic which seems to be a problem wh… --- ## [Elastic Agent (Defender) – Public + On-Prem Deployment Question](https://discuss.elastic.co/t/elastic-agent-defender-public-on-prem-deployment-question/383515)
**Author:** [@Animate4498](https://discuss.elastic.co/u/Animate4498)\ **Replies:** 8\ **Last updated:** [January 5, 2026, 1:08pm UTC](https://discuss.elastic.co/t/elastic-agent-defender-public-on-prem-deployment-question/383515 "2026-01-05T13:08:11Z")
My goal is to deploy the Elastic Agent with the Defender integration as an XDR solution on our clients and forward all security alerts to our on-prem SIEM. Fleet and the rest of the Elastic components are reachable from … --- ## [Logs from elasticsearch agents](https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361)
**Author:** [@TheJ](https://discuss.elastic.co/u/TheJ)\ **Replies:** 0\ **Last updated:** [January 5, 2026, 11:29am UTC](https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361 "2026-01-05T11:29:19Z")
Hi, I have an Elasticsearch cluster that keeps logs from services within a year. I have also connected 30 elasticagents and logs from these agents exist on the cluster forever. During debug, I realize that data streams … --- ## [Elastic agent is not sending data to elasticsearch cluster](https://discuss.elastic.co/t/elastic-agent-is-not-sending-data-to-elasticsearch-cluster/384080)
**Author:** [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\ **Replies:** 1\ **Last updated:** [December 18, 2025, 7:59am UTC](https://discuss.elastic.co/t/elastic-agent-is-not-sending-data-to-elasticsearch-cluster/384080 "2025-12-18T07:59:50Z")
Hello All, I recently upgraded elasticsearch cluster from 8.12 \> 8.19. Subsequently i also upgraded elastic-agent (fleet-server) to 8.19 which is healthy. But when i try to enroll new agent into it, it is in updating s… --- ## [After upgrading to 8.19.5(?)+, Elastic Agent no longer uses the configured proxy, resulting in a 'no such host' error when trying to download binaries.](https://discuss.elastic.co/t/after-upgrading-to-8-19-5-elastic-agent-no-longer-uses-the-configured-proxy-resulting-in-a-no-such-host-error-when-trying-to-download-binaries/384126)
**Author:** [@JPPereira](https://discuss.elastic.co/u/JPPereira)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 3:58pm UTC](https://discuss.elastic.co/t/after-upgrading-to-8-19-5-elastic-agent-no-longer-uses-the-configured-proxy-resulting-in-a-no-such-host-error-when-trying-to-download-binaries/384126 "2025-12-16T15:58:42Z")
Summary of Issue: Elastic Agent Binary Download Failing with DNS Error Since 8.19.5+ Environment Details Component Cluster 1 (Prod) Cluster 2 (Dev) Kibana Nodes 1 1 Data Nodes 9 (3 Hot/3 Warm/3 Cold) 4 (2 Hot/1… --- ## [Windows and Linux Integration to collect inventory data for Defend coverage (and CMDB)](https://discuss.elastic.co/t/windows-and-linux-integration-to-collect-inventory-data-for-defend-coverage-and-cmdb/384117)
**Author:** [@pimthu](https://discuss.elastic.co/u/pimthu)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 2:33pm UTC](https://discuss.elastic.co/t/windows-and-linux-integration-to-collect-inventory-data-for-defend-coverage-and-cmdb/384117 "2025-12-16T14:33:58Z")
We are an MSSP for many organisations and would like to produce Elastic Defend coverage figures. Currently, we need to collect through various cumbersome ways the AD or inventory data from Windows, Mac and Linux clients … --- ## [How do you replicate tagging in metricbeat/filebeat with the agent?](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 2\ **Last updated:** [December 12, 2025, 2:35pm UTC](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937 "2025-12-12T14:35:40Z")
I am in the process of migrating ~450 windows servers from using beats to the agent. All of these servers have metricbeat only and about 120 of those also have filebeat (doing some custom parsing that will be replicated … --- ## [My Status of Fleet Agent doesn't change from Updating to Heathy](https://discuss.elastic.co/t/my-status-of-fleet-agent-doesnt-change-from-updating-to-heathy/384003)
**Author:** [@duy270101](https://discuss.elastic.co/u/duy270101)\ **Replies:** 1\ **Last updated:** [December 12, 2025, 6:47am UTC](https://discuss.elastic.co/t/my-status-of-fleet-agent-doesnt-change-from-updating-to-heathy/384003 "2025-12-12T06:47:11Z")
My case. I set up for may lab. Please help me. Status don't change to Heathy. when install i added –insecure -f in the tail of command. --- ## [AWS Integration - Logs from CloudWatch error STS: AssumeRole, exceeded maximum number of attempts](https://discuss.elastic.co/t/aws-integration-logs-from-cloudwatch-error-sts-assumerole-exceeded-maximum-number-of-attempts/383936)
**Author:** [@carellevbt](https://discuss.elastic.co/u/carellevbt)\ **Replies:** 1\ **Last updated:** [December 12, 2025, 1:35am UTC](https://discuss.elastic.co/t/aws-integration-logs-from-cloudwatch-error-sts-assumerole-exceeded-maximum-number-of-attempts/383936 "2025-12-12T01:35:36Z")
Hello, We started seeing the below error on the AWS integrations, precisely for the “Collect Logs from CloudWatch”. getLogEventsFromCloudWatch failed: error FilterLogEvents with Paginator: operation error CloudWatch Lo… --- ## [Agent processor dissect question](https://discuss.elastic.co/t/agent-processor-dissect-question/383995)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 5:25pm UTC](https://discuss.elastic.co/t/agent-processor-dissect-question/383995 "2025-12-11T17:25:19Z")
I have an integration using Custom Logs with a processor using this dissect: - dissect: tokenizer: "%{date} %{time} %{action} %{protocol} %{src-ip} %{dst-ip} %{src-port} %{dst-port} %{size} %{tcpflags} %{tcpsyn} %{tc… [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=1) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=3)