# Elastic Agent

**URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=23

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 24

---

## [Azure Integration for injecting logs and metrics properly from an Azure event hub?](https://discuss.elastic.co/t/azure-integration-for-injecting-logs-and-metrics-properly-from-an-azure-event-hub/355022)

<div class="topic-metadata">

**Author:** [@juanmgarciaf](https://discuss.elastic.co/u/juanmgarciaf)\
**Replies:** 5\
**Last updated:** [March 12, 2024, 10:37am UTC](https://discuss.elastic.co/t/azure-integration-for-injecting-logs-and-metrics-properly-from-an-azure-event-hub/355022 "2024-03-12T10:37:32Z")

</div>

Hello! I'm using an "Azure Event Hub Input" integration in Kibana for trying to inject logs and metrics previously saved in an Azure Event Hub. I select all checks in Azure for sending all logs and metrics to that Eve…

---

## [Custom Logs - json - Why do we need to map fields?](https://discuss.elastic.co/t/custom-logs-json-why-do-we-need-to-map-fields/354542)

<div class="topic-metadata">

**Author:** [@jjwallaby](https://discuss.elastic.co/u/jjwallaby)\
**Replies:** 7\
**Last updated:** [March 11, 2024, 9:32pm UTC](https://discuss.elastic.co/t/custom-logs-json-why-do-we-need-to-map-fields/354542 "2024-03-11T21:32:05Z")

</div>

Hi, json objects fields are meant to be dynamic. Does 'Custom Logs' from the 'Elastic Agent' have a facility to map json fields on the fly as entry comes in ? If you do not have any mapping an error occurs 'could no…

---

## [How do I debug Agent custom logs and ingest pipeline?](https://discuss.elastic.co/t/how-do-i-debug-agent-custom-logs-and-ingest-pipeline/355193)

<div class="topic-metadata">

**Author:** [@Ross\_Wakelin](https://discuss.elastic.co/u/Ross_Wakelin)\
**Replies:** 0\
**Last updated:** [March 11, 2024, 8:33pm UTC](https://discuss.elastic.co/t/how-do-i-debug-agent-custom-logs-and-ingest-pipeline/355193 "2024-03-11T20:33:18Z")

</div>

Morning... I have created a custom log integration on some Windows servers to read the DNS debug logs. The logs get sent to a custom ingest pipeline which parses them into ECS and writes them to a data stream. I have i…

---

## [How to identify state of an IIS app pool from the IIS metrics: Elastic Agent](https://discuss.elastic.co/t/how-to-identify-state-of-an-iis-app-pool-from-the-iis-metrics-elastic-agent/355121)

<div class="topic-metadata">

**Author:** [@Paril\_Sanghvi](https://discuss.elastic.co/u/Paril_Sanghvi)\
**Replies:** 0\
**Last updated:** [March 11, 2024, 6:39am UTC](https://discuss.elastic.co/t/how-to-identify-state-of-an-iis-app-pool-from-the-iis-metrics-elastic-agent/355121 "2024-03-11T06:39:28Z")

</div>

Hi Everyone, I want to get status of App Pool from IIS server. I looked into metrics shipped by the integration but it does not have any metric related to it. Also some of my app in pool has status started and they are …

---

## [How to set/change Elastic Agent with same hostname](https://discuss.elastic.co/t/how-to-set-change-elastic-agent-with-same-hostname/354766)

<div class="topic-metadata">

**Author:** [@djarami726](https://discuss.elastic.co/u/djarami726)\
**Replies:** 6\
**Last updated:** [March 8, 2024, 3:53pm UTC](https://discuss.elastic.co/t/how-to-set-change-elastic-agent-with-same-hostname/354766 "2024-03-08T15:53:37Z")

</div>

I have installed the elastic agent on two linux VM machines and they have the same hostname on both VMs. Unfortunately, only one shows up on my list of installed agents. How do i change the name used for elastic agent …

---

## [Elastic Agent Is Failed to Start in Windows Server and Not Sending Data to Elastic Search](https://discuss.elastic.co/t/elastic-agent-is-failed-to-start-in-windows-server-and-not-sending-data-to-elastic-search/354456)

<div class="topic-metadata">

**Author:** [@nkreddyp](https://discuss.elastic.co/u/nkreddyp)\
**Replies:** 6\
**Last updated:** [March 6, 2024, 2:25pm UTC](https://discuss.elastic.co/t/elastic-agent-is-failed-to-start-in-windows-server-and-not-sending-data-to-elastic-search/354456 "2024-03-06T14:25:44Z")

</div>

Dear Team, I'm trying to integrate the windows server to ElK stack using fleet server , I have followed the steps as per the elk docs I have generated selfsigned certificate for fleet server and from kibana --\> Fleet -…

---

## [Elastic Agent Logs from UNC Path?](https://discuss.elastic.co/t/elastic-agent-logs-from-unc-path/354847)

<div class="topic-metadata">

**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\
**Replies:** 0\
**Last updated:** [March 6, 2024, 1:46pm UTC](https://discuss.elastic.co/t/elastic-agent-logs-from-unc-path/354847 "2024-03-06T13:46:14Z")

</div>

I am using Elastic Agent 8.12.1 on a Windows host. I have a requirement to ingest logs for an application which writes them directly to a share referenced UNC path from the host (e.g., \\\\myshare\\myapp\\logs\\log.json). Tha…

---

## [Agent Policy only allowed to feed to one namespace?](https://discuss.elastic.co/t/agent-policy-only-allowed-to-feed-to-one-namespace/354795)

<div class="topic-metadata">

**Author:** [@jjwallaby](https://discuss.elastic.co/u/jjwallaby)\
**Replies:** 0\
**Last updated:** [March 6, 2024, 5:33am UTC](https://discuss.elastic.co/t/agent-policy-only-allowed-to-feed-to-one-namespace/354795 "2024-03-06T05:33:53Z")

</div>

Hi, is it possible if an agent can feed into different multiple namespaces ? What I would like to do is feed different logs to different namespaces from a different app logs. The app logs are already have a prefix nam…

---

## [Network Disruption on Kubernetes Node with Elastic Security Integration on Debian](https://discuss.elastic.co/t/network-disruption-on-kubernetes-node-with-elastic-security-integration-on-debian/354202)

<div class="topic-metadata">

**Author:** [@Lolozini](https://discuss.elastic.co/u/Lolozini)\
**Replies:** 2\
**Last updated:** [March 4, 2024, 9:15am UTC](https://discuss.elastic.co/t/network-disruption-on-kubernetes-node-with-elastic-security-integration-on-debian/354202 "2024-03-04T09:15:35Z")

</div>

Hello, I am experiencing a issue where the private Kubernetes network fails on a node after setting up the Elastic Security integration with the Elastic Agent directly on a Debian server, which runs in parallel with ano…

---

## [FLeet-server](https://discuss.elastic.co/t/fleet-server/354475)

<div class="topic-metadata">

**Author:** [@My\_Bach\_Toan](https://discuss.elastic.co/u/My_Bach_Toan)\
**Replies:** 4\
**Last updated:** [March 1, 2024, 7:08pm UTC](https://discuss.elastic.co/t/fleet-server/354475 "2024-03-01T19:08:18Z")

</div>

When i tried to add elastic Agent to Windows host, this error happended

---

## [Elastic Agent - Fleet Server](https://discuss.elastic.co/t/elastic-agent-fleet-server/354547)

<div class="topic-metadata">

**Author:** [@My\_Bach\_Toan](https://discuss.elastic.co/u/My_Bach_Toan)\
**Replies:** 0\
**Last updated:** [March 1, 2024, 4:36pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet-server/354547 "2024-03-01T16:36:45Z")

</div>

I dont know how to fix

---

## [Problem with filebeat, it does not process multiline correctly](https://discuss.elastic.co/t/problem-with-filebeat-it-does-not-process-multiline-correctly/354425)

<div class="topic-metadata">

**Author:** [@San9](https://discuss.elastic.co/u/San9)\
**Replies:** 1\
**Last updated:** [February 29, 2024, 10:58am UTC](https://discuss.elastic.co/t/problem-with-filebeat-it-does-not-process-multiline-correctly/354425 "2024-02-29T10:58:09Z")

</div>

Hello. I have a problem setting up the filebeat agnet. The logs consist of several lines and I would like to send them as one message. I prepared the config, but for some reason it doesn’t work. tell me what the probl…

---

## [Agents upgradeable or not](https://discuss.elastic.co/t/agents-upgradeable-or-not/354354)

<div class="topic-metadata">

**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\
**Replies:** 0\
**Last updated:** [February 28, 2024, 2:34pm UTC](https://discuss.elastic.co/t/agents-upgradeable-or-not/354354 "2024-02-28T14:34:59Z")

</div>

Hello everyone, I have just upgraded my cluster to 8.12.2, now some of my agents are upgradeable, others (including the fleet server) are not. All of them are installed from tarballs and were able to be upgraded before…

---

## [Windows Server Integration to Elastic Search is failing elastic agent fleet enrollment is happening but elastic agent not starting and not sending data](https://discuss.elastic.co/t/windows-server-integration-to-elastic-search-is-failing-elastic-agent-fleet-enrollment-is-happening-but-elastic-agent-not-starting-and-not-sending-data/354239)

<div class="topic-metadata">

**Author:** [@nkreddyp](https://discuss.elastic.co/u/nkreddyp)\
**Replies:** 2\
**Last updated:** [February 28, 2024, 5:58am UTC](https://discuss.elastic.co/t/windows-server-integration-to-elastic-search-is-failing-elastic-agent-fleet-enrollment-is-happening-but-elastic-agent-not-starting-and-not-sending-data/354239 "2024-02-28T05:58:31Z")

</div>

please any one faces this kind of issue please help me i'm stuck almost from one month to integrate windows server due to this issue i have used selfsigned certificates for fleet server and Elasticsearch {"log.level":"i…

---

## [How to update elastic-agent API key?](https://discuss.elastic.co/t/how-to-update-elastic-agent-api-key/354293)

<div class="topic-metadata">

**Author:** [@Mang-Joo](https://discuss.elastic.co/u/Mang-Joo)\
**Replies:** 1\
**Last updated:** [February 28, 2024, 5:57am UTC](https://discuss.elastic.co/t/how-to-update-elastic-agent-api-key/354293 "2024-02-28T05:57:05Z")

</div>

hello. I want to unenroll and re-enroll an agent in fleet. Where can I update the API KEY? I want a way other than reinstalling.

---

## [Sending data to new Data Stream with Elastic Agent](https://discuss.elastic.co/t/sending-data-to-new-data-stream-with-elastic-agent/353926)

<div class="topic-metadata">

**Author:** [@wrender1](https://discuss.elastic.co/u/wrender1)\
**Replies:** 19\
**Last updated:** [February 27, 2024, 8:09pm UTC](https://discuss.elastic.co/t/sending-data-to-new-data-stream-with-elastic-agent/353926 "2024-02-27T20:09:54Z")

</div>

Hi, We are trying to use a Standalone Elastic Agent on Kubernetes. Right now it is creating indexes for us, and sending all container logs to it. The indexes end up looking like: logs-kubernetes.container\_logs-cluster-…

---

## [Elastic agent fleet server stuck in "updating" in UI](https://discuss.elastic.co/t/elastic-agent-fleet-server-stuck-in-updating-in-ui/354237)

<div class="topic-metadata">

**Author:** [@Marcus\_Berglund](https://discuss.elastic.co/u/Marcus_Berglund)\
**Replies:** 0\
**Last updated:** [February 27, 2024, 2:00pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet-server-stuck-in-updating-in-ui/354237 "2024-02-27T14:00:45Z")

</div>

Hi, When upgrading from 8.6.2 to 8.12.1 the fleet server agent is stuck at updating. Initially we missed the sha file, but that is fixed. Still no luck. The artifact repo is reachble and we are running on windows. we …

---

## [Lab mentions to add the path --certificate-authorities=/home/elastic/certs/ca/ca.crt. But doesn't say where to add. Or maybe I missed something](https://discuss.elastic.co/t/lab-mentions-to-add-the-path-certificate-authorities-home-elastic-certs-ca-ca-crt-but-doesnt-say-where-to-add-or-maybe-i-missed-something/354151)

<div class="topic-metadata">

**Author:** [@ericatwood](https://discuss.elastic.co/u/ericatwood)\
**Replies:** 0\
**Last updated:** [February 26, 2024, 9:41pm UTC](https://discuss.elastic.co/t/lab-mentions-to-add-the-path-certificate-authorities-home-elastic-certs-ca-ca-crt-but-doesnt-say-where-to-add-or-maybe-i-missed-something/354151 "2024-02-26T21:41:30Z")

</div>

!\[image|690x286\](upload://fDHjrY46od2qYIcWn7yTf2VEtIt.png

---

## [Json.keys\_under\_root ignored for JSON documents larger than 4096 bytes](https://discuss.elastic.co/t/json-keys-under-root-ignored-for-json-documents-larger-than-4096-bytes/354127)

<div class="topic-metadata">

**Author:** [@vegard](https://discuss.elastic.co/u/vegard)\
**Replies:** 0\
**Last updated:** [February 26, 2024, 2:46pm UTC](https://discuss.elastic.co/t/json-keys-under-root-ignored-for-json-documents-larger-than-4096-bytes/354127 "2024-02-26T14:46:38Z")

</div>

Hi, we seem to be hitting a hard limit on our Custom Logs integration for the Elastic Agent, ingesting json logs. We have the following custom configuration: json: keys\_under\_root: true This works fine for all json …

---

## [Fleet server certificate issue](https://discuss.elastic.co/t/fleet-server-certificate-issue/352839)

<div class="topic-metadata">

**Author:** [@Anand\_Hitachi](https://discuss.elastic.co/u/Anand_Hitachi)\
**Replies:** 3\
**Last updated:** [February 22, 2024, 12:29am UTC](https://discuss.elastic.co/t/fleet-server-certificate-issue/352839 "2024-02-22T00:29:38Z")

</div>

I'm getting this error while installing and enrolling fleet server on a windows host " Error: fleet-server failed: context canceled " (STARTING-\>FAILED): 1 error: file is not a certificate adding C:/elasticstack-ca/ela…

---

## [Recommended procedure for manually upgrading Fleet Managed agents on Windows](https://discuss.elastic.co/t/recommended-procedure-for-manually-upgrading-fleet-managed-agents-on-windows/353821)

<div class="topic-metadata">

**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Replies:** 0\
**Last updated:** [February 21, 2024, 10:41pm UTC](https://discuss.elastic.co/t/recommended-procedure-for-manually-upgrading-fleet-managed-agents-on-windows/353821 "2024-02-21T22:41:05Z")

</div>

Hello, We are starting to deploy thousands of Elastic Agents on our company in Windows and Linux servers, these servers are managed by multiple different infra teams, so every change on the servers needs to be done by t…

---

## [Data dosent show in Elasicsearch](https://discuss.elastic.co/t/data-dosent-show-in-elasicsearch/353695)

<div class="topic-metadata">

**Author:** [@yannik-rabenstein](https://discuss.elastic.co/u/yannik-rabenstein)\
**Replies:** 1\
**Last updated:** [February 21, 2024, 10:39am UTC](https://discuss.elastic.co/t/data-dosent-show-in-elasicsearch/353695 "2024-02-21T10:39:18Z")

</div>

I try to setup elasticstack in docker with Elasticsearch, Kibana and fleet-server as components. All components use the version 8.12.1 docker-compose.yml: services: setup: image: elasticsearch:${STACK\_VERSION} …

---

## [Configure global retention time (ILM) for all logs and metrics](https://discuss.elastic.co/t/configure-global-retention-time-ilm-for-all-logs-and-metrics/353722)

<div class="topic-metadata">

**Author:** [@lpeter](https://discuss.elastic.co/u/lpeter)\
**Replies:** 3\
**Last updated:** [February 20, 2024, 9:54pm UTC](https://discuss.elastic.co/t/configure-global-retention-time-ilm-for-all-logs-and-metrics/353722 "2024-02-20T21:54:59Z")

</div>

Hello! I'm using Elastic Agent with Fleet and Integrations. I'd like all collected data (metrics and logs) to be deleted after about N days. Is there a more elegant solution to this other than modifying the default "man…

---

## [Not able to get all RDS metrics to Elasticsearch](https://discuss.elastic.co/t/not-able-to-get-all-rds-metrics-to-elasticsearch/353676)

<div class="topic-metadata">

**Author:** [@arvind297](https://discuss.elastic.co/u/arvind297)\
**Replies:** 0\
**Last updated:** [February 20, 2024, 11:04am UTC](https://discuss.elastic.co/t/not-able-to-get-all-rds-metrics-to-elasticsearch/353676 "2024-02-20T11:04:12Z")

</div>

Hi, We are trying to configure elasticagent to send RDS metrics to Elasticsearch. Able to configure using AWS RDS integration and we are getting the metrics. But not getting all the metrics.From the documentation i unde…

---

## [Agents periodically disconnecting from Fleets](https://discuss.elastic.co/t/agents-periodically-disconnecting-from-fleets/353397)

<div class="topic-metadata">

**Author:** [@squatchulator](https://discuss.elastic.co/u/squatchulator)\
**Replies:** 1\
**Last updated:** [February 20, 2024, 7:40am UTC](https://discuss.elastic.co/t/agents-periodically-disconnecting-from-fleets/353397 "2024-02-20T07:40:47Z")

</div>

Version: 8.9.0 Hi there! Working on a SOC team where we manage agents for lots of local endpoints within our network. I'm pretty new to working with the stack, so I am hoping someone with more experience with agent issu…

---

## [Bind9 elastic agent integration](https://discuss.elastic.co/t/bind9-elastic-agent-integration/353412)

<div class="topic-metadata">

**Author:** [@Brennen\_Rose](https://discuss.elastic.co/u/Brennen_Rose)\
**Replies:** 0\
**Last updated:** [February 15, 2024, 9:16pm UTC](https://discuss.elastic.co/t/bind9-elastic-agent-integration/353412 "2024-02-15T21:16:31Z")

</div>

Hi there - we have setup a custom log ingestion pipeline from our DNS server running Bind. We had have an existing fleet agent running on that server, so we opted to add a custom pipeline with a grok for Bind9 logs. I am…

---

## [Elastic Agent installation on the window server 2012 r2](https://discuss.elastic.co/t/elastic-agent-installation-on-the-window-server-2012-r2/353364)

<div class="topic-metadata">

**Author:** [@Yogesh\_AS](https://discuss.elastic.co/u/Yogesh_AS)\
**Replies:** 1\
**Last updated:** [February 15, 2024, 12:15pm UTC](https://discuss.elastic.co/t/elastic-agent-installation-on-the-window-server-2012-r2/353364 "2024-02-15T12:15:12Z")

</div>

Hi All, I am installing the elastic agent in windows server r2 2012 edition where I am facing issue is I am unable to see the CPU and memory metrices in fleet management. please help me out to resolve issues but when I…

---

## [Fleet on GKE (ECK) behind a Google LB 502 errors](https://discuss.elastic.co/t/fleet-on-gke-eck-behind-a-google-lb-502-errors/353309)

<div class="topic-metadata">

**Author:** [@trudesea](https://discuss.elastic.co/u/trudesea)\
**Replies:** 0\
**Last updated:** [February 14, 2024, 8:36pm UTC](https://discuss.elastic.co/t/fleet-on-gke-eck-behind-a-google-lb-502-errors/353309 "2024-02-14T20:36:40Z")

</div>

Preformatted texto we run Elastic on GKE using ECK. We are on version 8.12. I just installed the Fleet server yesterday with 4 replicas and they are sitting behind a GCP classic http LB. The servers can be seen on the f…

---

## [Error uninstalling the elastic agent](https://discuss.elastic.co/t/error-uninstalling-the-elastic-agent/353142)

<div class="topic-metadata">

**Author:** [@Karan37](https://discuss.elastic.co/u/Karan37)\
**Replies:** 2\
**Last updated:** [February 14, 2024, 11:14am UTC](https://discuss.elastic.co/t/error-uninstalling-the-elastic-agent/353142 "2024-02-14T11:14:57Z")

</div>

i am running the uninstall command where the command have to be run but still showing error PS C:\\Program Files\\Elastic\\Agent\> .\\elastic-agent.exe uninstall Error: can only be uninstalled by executing the installed Elas…

---

## [System Integration dashboard somehow broken](https://discuss.elastic.co/t/system-integration-dashboard-somehow-broken/353177)

<div class="topic-metadata">

**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\
**Replies:** 1\
**Last updated:** [February 13, 2024, 2:15pm UTC](https://discuss.elastic.co/t/system-integration-dashboard-somehow-broken/353177 "2024-02-13T14:15:03Z")

</div>

I completely uninstalled and reinstalled the integration and it didnt help (as it is caused by the aggregation in the dashboard). My Dashbaord visualization is like this: There are some missing values (I do use the …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=22)

[Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=24)
