# Elastic Agent

**URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=22

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 23

---

## [Agent in fleet, how to change settings?](https://discuss.elastic.co/t/agent-in-fleet-how-to-change-settings/356857)

<div class="topic-metadata">

**Author:** [@jfrank](https://discuss.elastic.co/u/jfrank)\
**Replies:** 0\
**Last updated:** [April 5, 2024, 10:07am UTC](https://discuss.elastic.co/t/agent-in-fleet-how-to-change-settings/356857 "2024-04-05T10:07:51Z")

</div>

my elastic-agent is enrolled to fleet. Where can I change settings regarding json files from "/var/log/elastic-agent"? I want to stop writing it.

---

## [Integrations | could i install multi elastic agent on a host?](https://discuss.elastic.co/t/integrations-could-i-install-multi-elastic-agent-on-a-host/356834)

<div class="topic-metadata">

**Author:** [@Trung\_Le\_Thanh](https://discuss.elastic.co/u/Trung_Le_Thanh)\
**Replies:** 0\
**Last updated:** [April 5, 2024, 4:16am UTC](https://discuss.elastic.co/t/integrations-could-i-install-multi-elastic-agent-on-a-host/356834 "2024-04-05T04:16:51Z")

</div>

My windows machine run iis service, i want to collect iis logs with "IIS" integration and window logs with "Windows" integrations, i have installed and configured elastic-egent for "Windows" on my host, which was sendin…

---

## [Is it possible to install multiple agents concurrently on the same host?](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-agents-concurrently-on-the-same-host/347646)

<div class="topic-metadata">

**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\
**Replies:** 1\
**Last updated:** [April 4, 2024, 8:37am UTC](https://discuss.elastic.co/t/is-it-possible-to-install-multiple-agents-concurrently-on-the-same-host/347646 "2024-04-04T08:37:16Z")

</div>

Hi, We are planning to start monitoring our appliances (Windows server based) installed at customers sites using elastic-agent. However, some of our clients have their own elastic-agent already running on our appliance,…

---

## [Elastic Agent Imperva Integration](https://discuss.elastic.co/t/elastic-agent-imperva-integration/356718)

<div class="topic-metadata">

**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Replies:** 0\
**Last updated:** [April 3, 2024, 8:01pm UTC](https://discuss.elastic.co/t/elastic-agent-imperva-integration/356718 "2024-04-03T20:01:15Z")

</div>

I am attempting to migrate from GitHub - imperva/incapsula-logs-downloader: A Python script for downloading log files from Incapsula to the Elastic Agent Imperva integration to collect Imperva WAF logs. I'm using the AP…

---

## [Fleet unhealthy in GUI + could not setup certificate reloader can not convert 'object' into 'string'](https://discuss.elastic.co/t/fleet-unhealthy-in-gui-could-not-setup-certificate-reloader-can-not-convert-object-into-string/355997)

<div class="topic-metadata">

**Author:** [@ksmithdafm](https://discuss.elastic.co/u/ksmithdafm)\
**Replies:** 35\
**Last updated:** [April 2, 2024, 11:02am UTC](https://discuss.elastic.co/t/fleet-unhealthy-in-gui-could-not-setup-certificate-reloader-can-not-convert-object-into-string/355997 "2024-04-02T11:02:07Z")

</div>

Fleet Server unhealthy in GUI and from CLI. Hello All, I have been wrestling with adding the fleet server for sometime now. I am running self managed ELK with 3 nodes as follows. master/data - Also runs kibana data01 …

---

## [Uninstalling Elastic Agent 8.8.2 on Windows Devices](https://discuss.elastic.co/t/uninstalling-elastic-agent-8-8-2-on-windows-devices/356224)

<div class="topic-metadata">

**Author:** [@KrisD](https://discuss.elastic.co/u/KrisD)\
**Replies:** 1\
**Last updated:** [April 2, 2024, 3:52am UTC](https://discuss.elastic.co/t/uninstalling-elastic-agent-8-8-2-on-windows-devices/356224 "2024-04-02T03:52:13Z")

</div>

I’m attempting to uninstall Elastic Agent version 8.8.2 from Windows devices using a script. While the script successfully uninstalls the software on the first attempt, it doesn’t delete the installation folder. I have t…

---

## [Parsing Data in message field](https://discuss.elastic.co/t/parsing-data-in-message-field/356300)

<div class="topic-metadata">

**Author:** [@Sheperd403](https://discuss.elastic.co/u/Sheperd403)\
**Replies:** 1\
**Last updated:** [March 28, 2024, 6:29am UTC](https://discuss.elastic.co/t/parsing-data-in-message-field/356300 "2024-03-28T06:29:10Z")

</div>

I am quite new to Elastic altogether, namely elastic agent, so looking for some guidance! To further preface, I am calling this parsing, but based on what I am requesting, that may not be the correct term for what I am a…

---

## [When is it safe to delete a log file from a machine that runs Fleet Agent?](https://discuss.elastic.co/t/when-is-it-safe-to-delete-a-log-file-from-a-machine-that-runs-fleet-agent/356257)

<div class="topic-metadata">

**Author:** [@lizozom](https://discuss.elastic.co/u/lizozom)\
**Replies:** 2\
**Last updated:** [March 31, 2024, 4:22pm UTC](https://discuss.elastic.co/t/when-is-it-safe-to-delete-a-log-file-from-a-machine-that-runs-fleet-agent/356257 "2024-03-31T16:22:42Z")

</div>

I have several machines that run an Elastic Agent on them. One of the integrations I used is Custom Logs. Logs are written to a file with a rotating date (my-logs-DATE.log). When is a safe time to delete an old log fi…

---

## [Issue getting logs to flow into Kibana (Windows OS)](https://discuss.elastic.co/t/issue-getting-logs-to-flow-into-kibana-windows-os/356466)

<div class="topic-metadata">

**Author:** [@w0mbat](https://discuss.elastic.co/u/w0mbat)\
**Replies:** 1\
**Last updated:** [March 30, 2024, 3:32pm UTC](https://discuss.elastic.co/t/issue-getting-logs-to-flow-into-kibana-windows-os/356466 "2024-03-30T15:32:26Z")

</div>

Cannot seem to get syslogs to flow from our vPAN Palo appliance to Kibana. I verified the logs were indeed being sent from our appliance to the OS using Kiwi Syslog. Have completed the following steps...What am i missi…

---

## [Configuring PDB in Oracle Integration](https://discuss.elastic.co/t/configuring-pdb-in-oracle-integration/356394)

<div class="topic-metadata">

**Author:** [@gurbelunder](https://discuss.elastic.co/u/gurbelunder)\
**Replies:** 1\
**Last updated:** [March 28, 2024, 12:19pm UTC](https://discuss.elastic.co/t/configuring-pdb-in-oracle-integration/356394 "2024-03-28T12:19:46Z")

</div>

Hi everybody, actually I'm trying to configure an Oracle Multitenant Database with one CDB and one PDB in Oracle Integration in Elastic in Cloud on Version 8.12. Oracle Integration is version 1.24.3. First of all my CD…

---

## [Unable to enroll elastic agent on windows devices](https://discuss.elastic.co/t/unable-to-enroll-elastic-agent-on-windows-devices/356326)

<div class="topic-metadata">

**Author:** [@Patrick.kirk](https://discuss.elastic.co/u/Patrick.kirk)\
**Replies:** 0\
**Last updated:** [March 27, 2024, 6:53pm UTC](https://discuss.elastic.co/t/unable-to-enroll-elastic-agent-on-windows-devices/356326 "2024-03-27T18:53:36Z")

</div>

Elastic agent and on-prem cluster on 8.12.1. I'm trying to enroll the agent on windows devices and am getting failures "error starting tcp listener for runtime manger: listen tcp 127.0.0.1:6789: bind". "Error: failed to …

---

## [Send logs from Fleet Docker Integration to specific data stream](https://discuss.elastic.co/t/send-logs-from-fleet-docker-integration-to-specific-data-stream/352668)

<div class="topic-metadata">

**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\
**Replies:** 1\
**Last updated:** [March 25, 2024, 2:16pm UTC](https://discuss.elastic.co/t/send-logs-from-fleet-docker-integration-to-specific-data-stream/352668 "2024-03-25T14:16:02Z")

</div>

I am using Fleet to manage our deployment. Most of our container-based logging is through Kubernetes, using the Kubernetes integration which allows me to specify the data\_set.datastream to send the logs to (e.g., myapp.l…

---

## [How is the agent upgrade availability is detected in fleet env (on-prem)](https://discuss.elastic.co/t/how-is-the-agent-upgrade-availability-is-detected-in-fleet-env-on-prem/354956)

<div class="topic-metadata">

**Author:** [@marfrarsi](https://discuss.elastic.co/u/marfrarsi)\
**Replies:** 2\
**Last updated:** [March 25, 2024, 2:05pm UTC](https://discuss.elastic.co/t/how-is-the-agent-upgrade-availability-is-detected-in-fleet-env-on-prem/354956 "2024-03-25T14:05:21Z")

</div>

Hello! Elastic 3 node Linux cluster on prem, with some Elastic Agent managed by a fleet server. I've upgraded the whole stack from 8.11.3 to 8.12 (Elasticsearch, kibana and fleet server). Now I would like to upgrade al…

---

## [Fleet Setting output remote elasticsearch Status Unhealthy issues](https://discuss.elastic.co/t/fleet-setting-output-remote-elasticsearch-status-unhealthy-issues/355333)

<div class="topic-metadata">

**Author:** [@fa\_dai](https://discuss.elastic.co/u/fa_dai)\
**Replies:** 1\
**Last updated:** [March 25, 2024, 2:02pm UTC](https://discuss.elastic.co/t/fleet-setting-output-remote-elasticsearch-status-unhealthy-issues/355333 "2024-03-25T14:02:18Z")

</div>

Hello I set up remote elasticsearch and want to output kibana log to another elasticsearch cluster, but there is an authentication problem. In addition to obtaining the service token from remote elasticsearch, do I …

---

## [Elastic agent wont start fleet server after upgrade](https://discuss.elastic.co/t/elastic-agent-wont-start-fleet-server-after-upgrade/356072)

<div class="topic-metadata">

**Author:** [@jtrapozi](https://discuss.elastic.co/u/jtrapozi)\
**Replies:** 0\
**Last updated:** [March 25, 2024, 5:40am UTC](https://discuss.elastic.co/t/elastic-agent-wont-start-fleet-server-after-upgrade/356072 "2024-03-25T05:40:32Z")

</div>

I represent an Australian school that uses Elastic for logging and we really love the product. We have a single ELK server with a single ELK agent and Fleet server all on the same host running 8.10.1 After a recent upg…

---

## [Elastic Agent using Docker: "failed version compatibility check with elasticsearch: dial tcp localhost:9200: connect: connection"](https://discuss.elastic.co/t/elastic-agent-using-docker-failed-version-compatibility-check-with-elasticsearch-dial-tcp-localhost-connect-connection/356003)

<div class="topic-metadata">

**Author:** [@NikoCosmico01](https://discuss.elastic.co/u/NikoCosmico01)\
**Replies:** 1\
**Last updated:** [March 22, 2024, 4:00pm UTC](https://discuss.elastic.co/t/elastic-agent-using-docker-failed-version-compatibility-check-with-elasticsearch-dial-tcp-localhost-connect-connection/356003 "2024-03-22T16:00:47Z")

</div>

Hi, I am struggling adding elastic agent on docker. All the times I try to docker run the agent this error appears: \< "failed version compatibility check with elasticsearch: dial tcp localhost:9200: connect: connection…

---

## [I can't create agent on fleet server](https://discuss.elastic.co/t/i-cant-create-agent-on-fleet-server/355795)

<div class="topic-metadata">

**Author:** [@jed](https://discuss.elastic.co/u/jed)\
**Replies:** 0\
**Last updated:** [March 20, 2024, 9:21am UTC](https://discuss.elastic.co/t/i-cant-create-agent-on-fleet-server/355795 "2024-03-20T09:21:02Z")

</div>

I just add fleet server and I deleted now I install it's back but it's doesn't work for here is error. I try to research but can't solve this problem. Please help! Best regards.

---

## [Standalone Elastic Agent Missing Authentication Credentials](https://discuss.elastic.co/t/standalone-elastic-agent-missing-authentication-credentials/355459)

<div class="topic-metadata">

**Author:** [@tepus](https://discuss.elastic.co/u/tepus)\
**Replies:** 1\
**Last updated:** [March 19, 2024, 9:20am UTC](https://discuss.elastic.co/t/standalone-elastic-agent-missing-authentication-credentials/355459 "2024-03-19T09:20:08Z")

</div>

Dear Elastic Community, We're installing a standalone elastic agent as a fleet server on a server dedicated for it in an air-gapped environment. We use APIs instead of Kibana UI for creating a policy and a service token…

---

## [No output from AWS integrations](https://discuss.elastic.co/t/no-output-from-aws-integrations/355494)

<div class="topic-metadata">

**Author:** [@Paul\_Wagner](https://discuss.elastic.co/u/Paul_Wagner)\
**Replies:** 1\
**Last updated:** [March 19, 2024, 3:21am UTC](https://discuss.elastic.co/t/no-output-from-aws-integrations/355494 "2024-03-19T03:21:45Z")

</div>

I'm running Fleet server with multiple AWS integrations but I'm not getting any output from the integrations. Fleet server, which is running the integrations is outputting logs and metrics normally, the integrations are …

---

## [Node.js 1.1.9 vulnerability in elastic docker agent image CVE-2023-4228](https://discuss.elastic.co/t/node-js-1-1-9-vulnerability-in-elastic-docker-agent-image-cve-2023-4228/355605)

<div class="topic-metadata">

**Author:** [@miksonx](https://discuss.elastic.co/u/miksonx)\
**Replies:** 1\
**Last updated:** [March 18, 2024, 1:39pm UTC](https://discuss.elastic.co/t/node-js-1-1-9-vulnerability-in-elastic-docker-agent-image-cve-2023-4228/355605 "2024-03-18T13:39:14Z")

</div>

This issue is related to docker image elastic-agent-complete (8.12.1, 8.12.2) According the CVE-2023-4228 the Node.js 1.1.9 version is vulnerable. Description The ip package before 1.1.9 for Node.js might allow SSRF be…

---

## [Can we have Elastic agent policy for Dev and Prod Environments](https://discuss.elastic.co/t/can-we-have-elastic-agent-policy-for-dev-and-prod-environments/355591)

<div class="topic-metadata">

**Author:** [@manukoli1986](https://discuss.elastic.co/u/manukoli1986)\
**Replies:** 2\
**Last updated:** [March 18, 2024, 12:49pm UTC](https://discuss.elastic.co/t/can-we-have-elastic-agent-policy-for-dev-and-prod-environments/355591 "2024-03-18T12:49:55Z")

</div>

We were using beat prior to elastic agent. Now our requirement is Elastic agent to provision on dev and prod instances. I have gone thru the documentation process of how to setup and configure Elastic agent on remote ho…

---

## [Nginx-ingress-controller-access, \_geoip\_database\_unavailable\_GeoLite2-City.mmdb, \_geoip\_database\_unavailable\_GeoLite2-ASN.mmdb](https://discuss.elastic.co/t/nginx-ingress-controller-access-geoip-database-unavailable-geolite2-city-mmdb-geoip-database-unavailable-geolite2-asn-mmdb/353325)

<div class="topic-metadata">

**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\
**Replies:** 30\
**Last updated:** [March 18, 2024, 8:48am UTC](https://discuss.elastic.co/t/nginx-ingress-controller-access-geoip-database-unavailable-geolite2-city-mmdb-geoip-database-unavailable-geolite2-asn-mmdb/353325 "2024-03-18T08:48:27Z")

</div>

Hi sir, Enabled the nginx ingress controller integration on elastic agent (kubernetes env) but the tags related to geo locations which were populated earlier are now not coming. kindly guide on this part. tags \[nginx-…

---

## [Pub/Sub integration with JSON Processor: "Cannot index event (status=400): dropping event! Enable debug logs to view the event and cause."](https://discuss.elastic.co/t/pub-sub-integration-with-json-processor-cannot-index-event-status-400-dropping-event-enable-debug-logs-to-view-the-event-and-cause/354760)

<div class="topic-metadata">

**Author:** [@tommed](https://discuss.elastic.co/u/tommed)\
**Replies:** 12\
**Last updated:** [March 14, 2024, 3:57pm UTC](https://discuss.elastic.co/t/pub-sub-integration-with-json-processor-cannot-index-event-status-400-dropping-event-enable-debug-logs-to-view-the-event-and-cause/354760 "2024-03-14T15:57:11Z")

</div>

I have created a Pub/Sub integration instance which imports data from a topic and ingests it into Elastic. This part works as expected. If I then re-configure the integration and specify a custom ingest pipeline (which …

---

## [Not able to start standalone Elastic Agent in my windows machine](https://discuss.elastic.co/t/not-able-to-start-standalone-elastic-agent-in-my-windows-machine/355384)

<div class="topic-metadata">

**Author:** [@Raminder\_Gujral](https://discuss.elastic.co/u/Raminder_Gujral)\
**Replies:** 4\
**Last updated:** [March 14, 2024, 1:44pm UTC](https://discuss.elastic.co/t/not-able-to-start-standalone-elastic-agent-in-my-windows-machine/355384 "2024-03-14T13:44:57Z")

</div>

Can you please help - I am trying to start standalone elastic agent in my windows machine and it keeps trying connecting to end point without any success. Here are the logs please: ERROR MESSAGE: {"log.level":"info","@…

---

## [Can we collect DB metrics and logs using elastic agent](https://discuss.elastic.co/t/can-we-collect-db-metrics-and-logs-using-elastic-agent/355361)

<div class="topic-metadata">

**Author:** [@nkreddyp](https://discuss.elastic.co/u/nkreddyp)\
**Replies:** 0\
**Last updated:** [March 14, 2024, 5:08am UTC](https://discuss.elastic.co/t/can-we-collect-db-metrics-and-logs-using-elastic-agent/355361 "2024-03-14T05:08:55Z")

</div>

Dear Team, with the elastic agent can we collect the metrics and logs i have checked for the option in kibana integrations however it is showing to install the seperate metricbeat and filebeat for this , if any one use…

---

## [Please explain how to customize filebeat settings when using Agent](https://discuss.elastic.co/t/please-explain-how-to-customize-filebeat-settings-when-using-agent/355306)

<div class="topic-metadata">

**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Replies:** 1\
**Last updated:** [March 13, 2024, 3:03pm UTC](https://discuss.elastic.co/t/please-explain-how-to-customize-filebeat-settings-when-using-agent/355306 "2024-03-13T15:03:16Z")

</div>

I am used to Filebeat and customizing it to do what I want, but now am testing Agent and those same methods in Filebeat do not seem to work. Note: I started with Fleet, but moved to standalone agents at this point. I co…

---

## [Clear ELK installation cant add Fleet server 8.12](https://discuss.elastic.co/t/clear-elk-installation-cant-add-fleet-server-8-12/354944)

<div class="topic-metadata">

**Author:** [@hitmany](https://discuss.elastic.co/u/hitmany)\
**Replies:** 2\
**Last updated:** [March 13, 2024, 10:18am UTC](https://discuss.elastic.co/t/clear-elk-installation-cant-add-fleet-server-8-12/354944 "2024-03-13T10:18:44Z")

</div>

Hi there, I am install Elasticsearch and Kibana. All services using self-signed certificates generated with elasticsearch-certutil. :grinning: In the Kibana Fleet GUI interface, I added a Fleet server and selected Advan…

---

## [Problem in downloading fleet server](https://discuss.elastic.co/t/problem-in-downloading-fleet-server/355079)

<div class="topic-metadata">

**Author:** [@Rupa123](https://discuss.elastic.co/u/Rupa123)\
**Replies:** 1\
**Last updated:** [March 13, 2024, 9:52am UTC](https://discuss.elastic.co/t/problem-in-downloading-fleet-server/355079 "2024-03-13T09:52:51Z")

</div>

Hey, I have an issue in downloading fleet server over https, we are running elasticsearch and kibana on docker with https on LINUX machine RHEL8.6 , when we are installing fleet and agent with this command it is gettin…

---

## [Elastic Agent FortiAnalyzer integration](https://discuss.elastic.co/t/elastic-agent-fortianalyzer-integration/354936)

<div class="topic-metadata">

**Author:** [@mwitsas](https://discuss.elastic.co/u/mwitsas)\
**Replies:** 0\
**Last updated:** [March 7, 2024, 10:20am UTC](https://discuss.elastic.co/t/elastic-agent-fortianalyzer-integration/354936 "2024-03-07T10:20:05Z")

</div>

"This integration has been tested against FortiManager & FortiAnalyzer 7.2.2. Versions above this are expected to work but have not been tested." We will be running version v7.0.10-build0561 231025 (GA) FortiAnalyzer …

---

## [Change log level of add\_cloud\_metadata processor](https://discuss.elastic.co/t/change-log-level-of-add-cloud-metadata-processor/352087)

<div class="topic-metadata">

**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\
**Replies:** 6\
**Last updated:** [March 12, 2024, 2:08pm UTC](https://discuss.elastic.co/t/change-log-level-of-add-cloud-metadata-processor/352087 "2024-03-12T14:08:29Z")

</div>

Elastic Agent version: 8.11.3 The add\_cloud\_metadata processor is used in filebeat/metricbeat by default. When deploying non-cloud Elastic Agent on own premises, the processor tries to add the metadata and fails with er…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=21)

[Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=23)
