# Elastic Agent

**URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=21

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 22

---

## [Elastic agent errors: Error fetching data for metricset http.json: error making http request: Get "http://unix/stats": dial unix /opt/Elastic/Agent/data/tmp/fleet-server-default.sock: connect: no such file or directory](https://discuss.elastic.co/t/elastic-agent-errors-error-fetching-data-for-metricset-http-json-error-making-http-request-get-http-unix-stats-dial-unix-opt-elastic-agent-data-tmp-fleet-server-default-sock-connect-no-such-file-or-directory/358536)

<div class="topic-metadata">

**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\
**Replies:** 0\
**Last updated:** [May 1, 2024, 6:10am UTC](https://discuss.elastic.co/t/elastic-agent-errors-error-fetching-data-for-metricset-http-json-error-making-http-request-get-http-unix-stats-dial-unix-opt-elastic-agent-data-tmp-fleet-server-default-sock-connect-no-such-file-or-directory/358536 "2024-05-01T06:10:56Z")

</div>

getting these errors when i checked elastic agent error logs dashboard Error fetching data for metricset apache.status: error fetching data: HTTP error 403 in : 403 Forbidden Error fetching data for metricset beat.sta…

---

## [Filebeat does not connect to elastcisearch](https://discuss.elastic.co/t/filebeat-does-not-connect-to-elastcisearch/358138)

<div class="topic-metadata">

**Author:** [@Misa](https://discuss.elastic.co/u/Misa)\
**Replies:** 1\
**Last updated:** [April 30, 2024, 1:49pm UTC](https://discuss.elastic.co/t/filebeat-does-not-connect-to-elastcisearch/358138 "2024-04-30T13:49:18Z")

</div>

I have elasticsearch and kibana installed in a container. both working normally. but filebeat communication has not been working. When I run ./filebeat.exe test output in powershell I receive the following message: PS …

---

## [Dynamic input Configuration nginx (and other)](https://discuss.elastic.co/t/dynamic-input-configuration-nginx-and-other/358492)

<div class="topic-metadata">

**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\
**Replies:** 0\
**Last updated:** [April 30, 2024, 12:15pm UTC](https://discuss.elastic.co/t/dynamic-input-configuration-nginx-and-other/358492 "2024-04-30T12:15:50Z")

</div>

Hello I see that multiple inputs now support "Dynamic input Configuration". We use this with host environment variables to control input execution.(one policy multiple inputs, only execute when needed. This keeps number…

---

## [What is the appropriate configuration?](https://discuss.elastic.co/t/what-is-the-appropriate-configuration/358486)

<div class="topic-metadata">

**Author:** [@Fernandoc4d](https://discuss.elastic.co/u/Fernandoc4d)\
**Replies:** 0\
**Last updated:** [April 30, 2024, 11:35am UTC](https://discuss.elastic.co/t/what-is-the-appropriate-configuration/358486 "2024-04-30T11:35:58Z")

</div>

Greetings community. I have been trying for several days to get an ES instance ready which I have to connect various agents, remote hosts that are servers in production to collect a series of very specific metrics of th…

---

## [Error when installing elastic agent using M1 and Macos Sonoma](https://discuss.elastic.co/t/error-when-installing-elastic-agent-using-m1-and-macos-sonoma/358045)

<div class="topic-metadata">

**Author:** [@dwinda3678](https://discuss.elastic.co/u/dwinda3678)\
**Replies:** 0\
**Last updated:** [April 23, 2024, 4:09pm UTC](https://discuss.elastic.co/t/error-when-installing-elastic-agent-using-m1-and-macos-sonoma/358045 "2024-04-23T16:09:49Z")

</div>

Hello, im trying to install an elastic agent with fleet using macos Sonoma, but the installation always failed and showing : Error: failed to fix permissions: chown /Library/Elastic/Agent/data/elastic-agent-913c02/elast…

---

## [CEF Integration Dataset name](https://discuss.elastic.co/t/cef-integration-dataset-name/358230)

<div class="topic-metadata">

**Author:** [@jsalbre](https://discuss.elastic.co/u/jsalbre)\
**Replies:** 2\
**Last updated:** [April 29, 2024, 1:54pm UTC](https://discuss.elastic.co/t/cef-integration-dataset-name/358230 "2024-04-29T13:54:40Z")

</div>

Is there a hidden configuration setting (or plans to add a configuration setting) to change the dataset name in the CEF integration, like most other integrations? We're stuck with "logs-cef.log-default" for our data stre…

---

## [Elastic\_agent.metricbeat error fetching data from metricsets.kubernetes.system](https://discuss.elastic.co/t/elastic-agent-metricbeat-error-fetching-data-from-metricsets-kubernetes-system/358398)

<div class="topic-metadata">

**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\
**Replies:** 2\
**Last updated:** [April 29, 2024, 10:02am UTC](https://discuss.elastic.co/t/elastic-agent-metricbeat-error-fetching-data-from-metricsets-kubernetes-system/358398 "2024-04-29T10:02:32Z")

</div>

Sir, Deployed elastic agent (fleet managed) in kubernetes cluster but the metric related details are not getting shown in the dashboards and observing the below errors. Kindly help us resolve the issue. \[elastic\_agent.…

---

## [Elastic Agent Fleet](https://discuss.elastic.co/t/elastic-agent-fleet/358377)

<div class="topic-metadata">

**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\
**Replies:** 0\
**Last updated:** [April 28, 2024, 6:30pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet/358377 "2024-04-28T18:30:36Z")

</div>

Hi Folks, Can somebody help me understand with the following questions? What is the difference wrt data flow or loss if two machines are using a single fleet policy and different policy? When we use fleet in Elast…

---

## [Custom UDP Logs Integration Not Ingesting Data](https://discuss.elastic.co/t/custom-udp-logs-integration-not-ingesting-data/358136)

<div class="topic-metadata">

**Author:** [@callum](https://discuss.elastic.co/u/callum)\
**Replies:** 7\
**Last updated:** [April 25, 2024, 3:21pm UTC](https://discuss.elastic.co/t/custom-udp-logs-integration-not-ingesting-data/358136 "2024-04-25T15:21:46Z")

</div>

I currently have the 'Custom UDP Logs' integration setup on an Elastic Agent. It's configured to listen on all interfaces for port 9514: All other options are left as default, with the Syslog Options and custom pipel…

---

## [How to monitor the services on linux machine using the elastic agent](https://discuss.elastic.co/t/how-to-monitor-the-services-on-linux-machine-using-the-elastic-agent/358023)

<div class="topic-metadata">

**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\
**Replies:** 2\
**Last updated:** [April 24, 2024, 7:13am UTC](https://discuss.elastic.co/t/how-to-monitor-the-services-on-linux-machine-using-the-elastic-agent/358023 "2024-04-24T07:13:05Z")

</div>

Sir, i have installed elastic agent in a linux machine and i want to monitor the services. How to achieve that?

---

## [File integrity monitoring integration to get current filesystem state](https://discuss.elastic.co/t/file-integrity-monitoring-integration-to-get-current-filesystem-state/356277)

<div class="topic-metadata">

**Author:** [@pstmps](https://discuss.elastic.co/u/pstmps)\
**Replies:** 0\
**Last updated:** [March 27, 2024, 11:58am UTC](https://discuss.elastic.co/t/file-integrity-monitoring-integration-to-get-current-filesystem-state/356277 "2024-03-27T11:58:28Z")

</div>

I am using elastic agent and the file integrity monitoring integration (1.14.1) to watch a folder and its subfolders for changes. This works fine but in order to get the true state of the filesystem I have to condense t…

---

## [Elastic Agent Installation for Elastic Observability Engineer Certification Lab](https://discuss.elastic.co/t/elastic-agent-installation-for-elastic-observability-engineer-certification-lab/357953)

<div class="topic-metadata">

**Author:** [@sujay](https://discuss.elastic.co/u/sujay)\
**Replies:** 0\
**Last updated:** [April 23, 2024, 2:07am UTC](https://discuss.elastic.co/t/elastic-agent-installation-for-elastic-observability-engineer-certification-lab/357953 "2024-04-23T02:07:45Z")

</div>

I need help with installing/uninstalling EA in Lab 2.1 Its giving my option to first install Fleet Server and then configure Agent, however the course Lab material says other wise I also need help to delete the content…

---

## [Restart Elastic Agent from Fleet Server](https://discuss.elastic.co/t/restart-elastic-agent-from-fleet-server/357946)

<div class="topic-metadata">

**Author:** [@Ather\_Imam\_Danish](https://discuss.elastic.co/u/Ather_Imam_Danish)\
**Replies:** 4\
**Last updated:** [April 23, 2024, 1:45am UTC](https://discuss.elastic.co/t/restart-elastic-agent-from-fleet-server/357946 "2024-04-23T01:45:11Z")

</div>

I want to restart Elastic Agent from Fleet server, because many time elastic agent gets in offline state and every time I restart it manually,

---

## [Elasticsearch Agent Issue](https://discuss.elastic.co/t/elasticsearch-agent-issue/357935)

<div class="topic-metadata">

**Author:** [@Amadavus](https://discuss.elastic.co/u/Amadavus)\
**Replies:** 0\
**Last updated:** [April 22, 2024, 6:21pm UTC](https://discuss.elastic.co/t/elasticsearch-agent-issue/357935 "2024-04-22T18:21:52Z")

</div>

Apologies if this is the incorrect section to ask this. Currently the Fleet server and the agent are both Windows Servers. I have recently started in a new environment where Elasticsearch was already set up. when I jo…

---

## [Check point elastic agent integration not receiving traffic](https://discuss.elastic.co/t/check-point-elastic-agent-integration-not-receiving-traffic/357922)

<div class="topic-metadata">

**Author:** [@Fantaunix](https://discuss.elastic.co/u/Fantaunix)\
**Replies:** 0\
**Last updated:** [April 22, 2024, 3:46pm UTC](https://discuss.elastic.co/t/check-point-elastic-agent-integration-not-receiving-traffic/357922 "2024-04-22T15:46:12Z")

</div>

hi all, i've installed an elastic agent on an host where checkpoint firewall sends logs but after several checks all is configured as well but the integration is not receiving anything. could someone share his configur…

---

## [CEL integration: Resource timeout does not work](https://discuss.elastic.co/t/cel-integration-resource-timeout-does-not-work/357806)

<div class="topic-metadata">

**Author:** [@Denis\_Pudov](https://discuss.elastic.co/u/Denis_Pudov)\
**Replies:** 0\
**Last updated:** [April 19, 2024, 3:32pm UTC](https://discuss.elastic.co/t/cel-integration-resource-timeout-does-not-work/357806 "2024-04-19T15:32:21Z")

</div>

Hi I have a kibana custom resource with CEL integration like this: apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: kibana namespace: kibana spec: version: 8.13.2 ... config: ... xpack.flee…

---

## [Custom API intergration - Response Pagination](https://discuss.elastic.co/t/custom-api-intergration-response-pagination/356396)

<div class="topic-metadata">

**Author:** [@rrensen](https://discuss.elastic.co/u/rrensen)\
**Replies:** 1\
**Last updated:** [April 19, 2024, 2:55pm UTC](https://discuss.elastic.co/t/custom-api-intergration-response-pagination/356396 "2024-04-19T14:55:01Z")

</div>

Hi, i am trying to achieve pagination with the Custom API. The response header of the original call has the following information Date: Wed, 27 Mar 2024 14:51:36 GMT Content-Type: application/json; charset=utf-8 Transf…

---

## [Elastic Agent exclude\_files error parsing regexp invalid nested repetition operator](https://discuss.elastic.co/t/elastic-agent-exclude-files-error-parsing-regexp-invalid-nested-repetition-operator/357649)

<div class="topic-metadata">

**Author:** [@Ryan\_Downey](https://discuss.elastic.co/u/Ryan_Downey)\
**Replies:** 1\
**Last updated:** [April 17, 2024, 7:30pm UTC](https://discuss.elastic.co/t/elastic-agent-exclude-files-error-parsing-regexp-invalid-nested-repetition-operator/357649 "2024-04-17T19:30:16Z")

</div>

When using the exclude\_files processor I'm seeing the error: \[elastic\_agent\]\[error\] Unit state changed (CONFIGURING-\>FAILED): error parsing regexp: invalid nested repetition operator: \*\* accessing 'exclude\_files.0' T…

---

## [How create agent policy for openshift env without integration](https://discuss.elastic.co/t/how-create-agent-policy-for-openshift-env-without-integration/357638)

<div class="topic-metadata">

**Author:** [@Fantaunix](https://discuss.elastic.co/u/Fantaunix)\
**Replies:** 0\
**Last updated:** [April 17, 2024, 2:55pm UTC](https://discuss.elastic.co/t/how-create-agent-policy-for-openshift-env-without-integration/357638 "2024-04-17T14:55:41Z")

</div>

Hi all, i saw there is not an agent integration for openshift, so could you suggest how to create a policy for that env? i tried to import that logs with a pipeline but that logs are not readable or not in json format,…

---

## [Elastic Agent Android](https://discuss.elastic.co/t/elastic-agent-android/357302)

<div class="topic-metadata">

**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\
**Replies:** 1\
**Last updated:** [April 16, 2024, 8:25am UTC](https://discuss.elastic.co/t/elastic-agent-android/357302 "2024-04-16T08:25:32Z")

</div>

Hey there, My name is Martin and I am a security engineer that had a bit too much free time....so I made a thing: It's called it Elastic Agent Android and it's a way to finally add your Android mobile devices into Flee…

---

## [Azure Activity Logs Agent Integration event message parsing and further field usage](https://discuss.elastic.co/t/azure-activity-logs-agent-integration-event-message-parsing-and-further-field-usage/356822)

<div class="topic-metadata">

**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\
**Replies:** 6\
**Last updated:** [April 13, 2024, 3:21am UTC](https://discuss.elastic.co/t/azure-activity-logs-agent-integration-event-message-parsing-and-further-field-usage/356822 "2024-04-13T03:21:15Z")

</div>

Trying to understand where is the issue and what can be done regarding parsing and information further usage. Azure Activity Logs are streamed to Event Hub from where Standalone Agent (version 8.12.1) picks them up and i…

---

## [Fleet Server on host Ubuntu and Elastic Agent on Window](https://discuss.elastic.co/t/fleet-server-on-host-ubuntu-and-elastic-agent-on-window/356575)

<div class="topic-metadata">

**Author:** [@My\_Bach\_Toan](https://discuss.elastic.co/u/My_Bach_Toan)\
**Replies:** 3\
**Last updated:** [April 13, 2024, 12:37am UTC](https://discuss.elastic.co/t/fleet-server-on-host-ubuntu-and-elastic-agent-on-window/356575 "2024-04-13T00:37:55Z")

</div>

I have a Fleet Server on Ubuntu and i try to add elastic agent on Window. i dont know how to fix it !!! HELP ME

---

## [Can an host be enrolled in multiple agent policies on fleet](https://discuss.elastic.co/t/can-an-host-be-enrolled-in-multiple-agent-policies-on-fleet/357232)

<div class="topic-metadata">

**Author:** [@Fantaunix](https://discuss.elastic.co/u/Fantaunix)\
**Replies:** 1\
**Last updated:** [April 11, 2024, 6:06pm UTC](https://discuss.elastic.co/t/can-an-host-be-enrolled-in-multiple-agent-policies-on-fleet/357232 "2024-04-11T18:06:39Z")

</div>

Hi all, i would know if is possible to enroll an host within 2 different agent policies in fleet. E.G myserver is a windows server and also a DNS server so i would apply a windows server agent policy with 3 integration …

---

## [Unknown domain contacted in air-gapped environment](https://discuss.elastic.co/t/unknown-domain-contacted-in-air-gapped-environment/356950)

<div class="topic-metadata">

**Author:** [@popeio](https://discuss.elastic.co/u/popeio)\
**Replies:** 3\
**Last updated:** [April 11, 2024, 12:23pm UTC](https://discuss.elastic.co/t/unknown-domain-contacted-in-air-gapped-environment/356950 "2024-04-11T12:23:46Z")

</div>

Hey Community! In one of our air-gapped environments we've recently observed some firewall logs pointing to cloud.security.elastic.co. To me, it smells a lot like artifacts.security.elastic.co, so it would be a pretty i…

---

## [Can Elastic Agent ingest from logstash?](https://discuss.elastic.co/t/can-elastic-agent-ingest-from-logstash/356105)

<div class="topic-metadata">

**Author:** [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\
**Replies:** 1\
**Last updated:** [April 9, 2024, 10:53am UTC](https://discuss.elastic.co/t/can-elastic-agent-ingest-from-logstash/356105 "2024-04-09T10:53:47Z")

</div>

I'm trying to ingest data from MongoDB, not database metrics but the data from a collection stored in MongoDB. There's GitHub - phutchins/logstash-input-mongodb: MongoDB input plugin for Logstash, but it's a bit outdated…

---

## [No result found error on transaction logs, audit event and error logs](https://discuss.elastic.co/t/no-result-found-error-on-transaction-logs-audit-event-and-error-logs/357052)

<div class="topic-metadata">

**Author:** [@Gopikrishna\_Panduran](https://discuss.elastic.co/u/Gopikrishna_Panduran)\
**Replies:** 0\
**Last updated:** [April 9, 2024, 9:56am UTC](https://discuss.elastic.co/t/no-result-found-error-on-transaction-logs-audit-event-and-error-logs/357052 "2024-04-09T09:56:27Z")

</div>

i have integrated sql on elastic cloud but, no result found on transaction logs, audit event and error logs

---

## [Error no pem block while enrolling the Fleet Server with encrypted private Key](https://discuss.elastic.co/t/error-no-pem-block-while-enrolling-the-fleet-server-with-encrypted-private-key/356988)

<div class="topic-metadata">

**Author:** [@madra](https://discuss.elastic.co/u/madra)\
**Replies:** 0\
**Last updated:** [April 8, 2024, 3:11pm UTC](https://discuss.elastic.co/t/error-no-pem-block-while-enrolling-the-fleet-server-with-encrypted-private-key/356988 "2024-04-08T15:11:47Z")

</div>

hello, We are getting the following error while enrolling the fleet Server: " "message":"Fleet Server - Error - 1 error: no PEM blocks" elastic-agent enroll --force \\ --fleet-server-es="https:elasticsearch\_node…

---

## [Kubernetes dashbords are not showing any metrics](https://discuss.elastic.co/t/kubernetes-dashbords-are-not-showing-any-metrics/356799)

<div class="topic-metadata">

**Author:** [@sichi](https://discuss.elastic.co/u/sichi)\
**Replies:** 0\
**Last updated:** [April 4, 2024, 4:24pm UTC](https://discuss.elastic.co/t/kubernetes-dashbords-are-not-showing-any-metrics/356799 "2024-04-04T16:24:14Z")

</div>

Hello there' I'm a newbie to elasticsearch. I have a k8s cluster which I want to monitor through the fleet integration. I have the elk with fleet established. I have elastic-agent running on my nodes as linux agent and …

---

## [Elastic-agent - Custom logs - no asn fields](https://discuss.elastic.co/t/elastic-agent-custom-logs-no-asn-fields/356883)

<div class="topic-metadata">

**Author:** [@dmgeurts](https://discuss.elastic.co/u/dmgeurts)\
**Replies:** 5\
**Last updated:** [April 7, 2024, 10:32pm UTC](https://discuss.elastic.co/t/elastic-agent-custom-logs-no-asn-fields/356883 "2024-04-07T22:32:24Z")

</div>

When using Elastic Agent, one can't use the GeoIP processor, presumably because it's built-in. It does the location lookup well, but the ASN details are missing and I've not found a way yet to toggle a setting for this. …

---

## [Facing TLS handshake error in Fleet server elastic agent logs](https://discuss.elastic.co/t/facing-tls-handshake-error-in-fleet-server-elastic-agent-logs/356398)

<div class="topic-metadata">

**Author:** [@Shayan\_Ahmed](https://discuss.elastic.co/u/Shayan_Ahmed)\
**Replies:** 4\
**Last updated:** [April 5, 2024, 3:21pm UTC](https://discuss.elastic.co/t/facing-tls-handshake-error-in-fleet-server-elastic-agent-logs/356398 "2024-04-05T15:21:34Z")

</div>

Hi all, I have configured a Fleet server on my EC2. All setup is working fine, but currently, I am facing a TLS handshake error in the Fleet server elastic agent logs. {"log.level":"error","service.name":"fleet-server"…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=20)

[Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=22)
