# Elastic Agent

**URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=24

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 25

---

## [Integration Oracle Cloud Kafka + Elastic-agent doesn't work](https://discuss.elastic.co/t/integration-oracle-cloud-kafka-elastic-agent-doesnt-work/353155)

<div class="topic-metadata">

**Author:** [@Death](https://discuss.elastic.co/u/Death)\
**Replies:** 0\
**Last updated:** [February 13, 2024, 10:57am UTC](https://discuss.elastic.co/t/integration-oracle-cloud-kafka-elastic-agent-doesnt-work/353155 "2024-02-13T10:57:20Z")

</div>

Good afternoon. At the moment, there was an attempt to connect to collect logs from Oracle cloud Audit logs via Kafka, and everything worked through logstash. Now when I try to use Custom Kafka Integration in elasticsear…

---

## [Elastic Defend integration failed to upgrade](https://discuss.elastic.co/t/elastic-defend-integration-failed-to-upgrade/352583)

<div class="topic-metadata">

**Author:** [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\
**Replies:** 4\
**Last updated:** [February 12, 2024, 5:05pm UTC](https://discuss.elastic.co/t/elastic-defend-integration-failed-to-upgrade/352583 "2024-02-12T17:05:33Z")

</div>

I upgraded elastic version to 8.12.0 recently. Today, when I tried to upgrade my agents, they are stuck in "unhealthy" state with a few errors stating Download failure and "No action taken" (screenshot attached). What c…

---

## [Add integration for Gitlab monitoring](https://discuss.elastic.co/t/add-integration-for-gitlab-monitoring/353038)

<div class="topic-metadata">

**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\
**Replies:** 2\
**Last updated:** [February 12, 2024, 9:48am UTC](https://discuss.elastic.co/t/add-integration-for-gitlab-monitoring/353038 "2024-02-12T09:48:23Z")

</div>

We have our own on-premise Gitlab server, which we want to monitor using Elastic Stack. We are currently using Fleet-managed Elastic Agent to ship data from our different systems. As stated out above, we now want to ing…

---

## [Nginx ingress controller integration is not working](https://discuss.elastic.co/t/nginx-ingress-controller-integration-is-not-working/352592)

<div class="topic-metadata">

**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\
**Replies:** 5\
**Last updated:** [February 7, 2024, 6:11am UTC](https://discuss.elastic.co/t/nginx-ingress-controller-integration-is-not-working/352592 "2024-02-07T06:11:10Z")

</div>

Hi, we have enabled the kubernetes and nginx ingress controller integration on the elastic agent \[managed with fleet\] but the access & error logs are not coming and getting the below errors. 04:19.949 elastic\_agent \[…

---

## [Agent 8.12.0 Standalone ignoring agent.logging settings](https://discuss.elastic.co/t/agent-8-12-0-standalone-ignoring-agent-logging-settings/352441)

<div class="topic-metadata">

**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Replies:** 0\
**Last updated:** [February 2, 2024, 6:33pm UTC](https://discuss.elastic.co/t/agent-8-12-0-standalone-ignoring-agent-logging-settings/352441 "2024-02-02T18:33:23Z")

</div>

I have these settings logging: level: error files: name: elastic-agent keepfiles: 7 metrics: enabled: false logging.level:error is not working. I am still seeing info and warning level logs. …

---

## [AWS S3 buclet with SQS failed processing SQS S3 event notification](https://discuss.elastic.co/t/aws-s3-buclet-with-sqs-failed-processing-sqs-s3-event-notification/350664)

<div class="topic-metadata">

**Author:** [@Merdesz](https://discuss.elastic.co/u/Merdesz)\
**Replies:** 2\
**Last updated:** [February 2, 2024, 9:01am UTC](https://discuss.elastic.co/t/aws-s3-buclet-with-sqs-failed-processing-sqs-s3-event-notification/350664 "2024-02-02T09:01:54Z")

</div>

Hi! Trying to set up the AWS Cloudtrail integration with elastic-agent/fleet. The integration is able to pull the SQS messages, but then it says "Failed processing SQS message. AWS Permissions: And it doesn't …

---

## [Add custom fields to metadata with elastic agent jar](https://discuss.elastic.co/t/add-custom-fields-to-metadata-with-elastic-agent-jar/352370)

<div class="topic-metadata">

**Author:** [@Namita\_Jaokar](https://discuss.elastic.co/u/Namita_Jaokar)\
**Replies:** 0\
**Last updated:** [February 2, 2024, 7:52am UTC](https://discuss.elastic.co/t/add-custom-fields-to-metadata-with-elastic-agent-jar/352370 "2024-02-02T07:52:13Z")

</div>

Hi, I need to add custom fields in metadata of the transactions captured by the java agent jar . Is there any way I can achieve this? I read about global\_labels inclusion in elastic agent properties file, But i need to…

---

## [Prometheus integration](https://discuss.elastic.co/t/prometheus-integration/352210)

<div class="topic-metadata">

**Author:** [@Lukasz\_Skrzat](https://discuss.elastic.co/u/Lukasz_Skrzat)\
**Replies:** 0\
**Last updated:** [January 31, 2024, 4:05pm UTC](https://discuss.elastic.co/t/prometheus-integration/352210 "2024-01-31T16:05:54Z")

</div>

I have a question/problem. I have several endpoints from Java applications /actuator/prometheus with metrics. Until now, all were aggregated by Prometheus, but I want to fully transition to ECK, so I'm trying to configur…

---

## [Need to disable insecure SSL cyphers/TLS 1.1 on Elastic Agent](https://discuss.elastic.co/t/need-to-disable-insecure-ssl-cyphers-tls-1-1-on-elastic-agent/352051)

<div class="topic-metadata">

**Author:** [@salemone](https://discuss.elastic.co/u/salemone)\
**Replies:** 3\
**Last updated:** [January 31, 2024, 3:45pm UTC](https://discuss.elastic.co/t/need-to-disable-insecure-ssl-cyphers-tls-1-1-on-elastic-agent/352051 "2024-01-31T15:45:55Z")

</div>

On a recent vulnerability scan we had findings for the Elastic Agent Fleet Server for having TLS 1.1 enabled along with insecure ciphers on port 8220. I have a client asking that we fix this... I added the below to ela…

---

## [I want to calculate the nginx http latency from event.original field/keyword](https://discuss.elastic.co/t/i-want-to-calculate-the-nginx-http-latency-from-event-original-field-keyword/349994)

<div class="topic-metadata">

**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\
**Replies:** 20\
**Last updated:** [January 31, 2024, 2:54pm UTC](https://discuss.elastic.co/t/i-want-to-calculate-the-nginx-http-latency-from-event-original-field-keyword/349994 "2024-01-31T14:54:47Z")

</div>

im trying to calculate the nginx http latency from event.original field. event.original 172.29.55.40 - - \[27/Dec/2023:10:08:14 +0530\] "POST /prod/requestJson HTTP/1.1" 200 607 "-" "Go-http-client/1.1" 0.486 For exampl…

---

## [How to change an agent name in ELK 8.11?](https://discuss.elastic.co/t/how-to-change-an-agent-name-in-elk-8-11/352196)

<div class="topic-metadata">

**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\
**Replies:** 0\
**Last updated:** [January 31, 2024, 2:20pm UTC](https://discuss.elastic.co/t/how-to-change-an-agent-name-in-elk-8-11/352196 "2024-01-31T14:20:04Z")

</div>

In the previous version I could change it by going into the metricbeat.yml in the installation file of the agent but as I upgraded the version from 8.5.1 to 8.11.3 the files aren't there anymore.

---

## [Install Elastic Agent 8.12 via SCCM](https://discuss.elastic.co/t/install-elastic-agent-8-12-via-sccm/352032)

<div class="topic-metadata">

**Author:** [@gnatola](https://discuss.elastic.co/u/gnatola)\
**Replies:** 6\
**Last updated:** [January 31, 2024, 2:17pm UTC](https://discuss.elastic.co/t/install-elastic-agent-8-12-via-sccm/352032 "2024-01-31T14:17:00Z")

</div>

Is there a method for installing the Elastic Agent via SCCM? If yes, after installing via SCCM can upgrades be managed in the Fleet page of the Elastic Dashboard? Thank you.

---

## [Synthetics | failed to verify certificate: x509](https://discuss.elastic.co/t/synthetics-failed-to-verify-certificate-x509/351826)

<div class="topic-metadata">

**Author:** [@Aldair\_Barrios](https://discuss.elastic.co/u/Aldair_Barrios)\
**Replies:** 3\
**Last updated:** [January 30, 2024, 9:08pm UTC](https://discuss.elastic.co/t/synthetics-failed-to-verify-certificate-x509/351826 "2024-01-30T21:08:19Z")

</div>

Hello, everyone! I've been trying for a few weeks to use Elasticsearch synthetic monitors. I'm following the documentation Run Elastic Agent in a container | Fleet and Elastic Agent Guide \[8.11\] | Elastic to install the…

---

## [Elastic agent can't reroute docs to a different index](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651)

<div class="topic-metadata">

**Author:** [@lizozom](https://discuss.elastic.co/u/lizozom)\
**Replies:** 4\
**Last updated:** [January 30, 2024, 4:41pm UTC](https://discuss.elastic.co/t/elastic-agent-cant-reroute-docs-to-a-different-index/351651 "2024-01-30T16:41:04Z")

</div>

I have fleet agents with a custom logs. I want to route some of the logs to a different index. I created the index task-logs and in the integration, I defined an reroute ingest pipeline. However,the documents don't rea…

---

## [How is elastic agent gathering statistics?](https://discuss.elastic.co/t/how-is-elastic-agent-gathering-statistics/352028)

<div class="topic-metadata">

**Author:** [@aorona](https://discuss.elastic.co/u/aorona)\
**Replies:** 0\
**Last updated:** [January 29, 2024, 6:11pm UTC](https://discuss.elastic.co/t/how-is-elastic-agent-gathering-statistics/352028 "2024-01-29T18:11:51Z")

</div>

Is elastic agent parsing the text output of observability tools or is it reading directly from the OS libraries and kernel interfaces?

---

## [Elastic-agent fleet upgrade windows - DNS lookup failure](https://discuss.elastic.co/t/elastic-agent-fleet-upgrade-windows-dns-lookup-failure/351992)

<div class="topic-metadata">

**Author:** [@beno](https://discuss.elastic.co/u/beno)\
**Replies:** 0\
**Last updated:** [January 29, 2024, 1:17pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet-upgrade-windows-dns-lookup-failure/351992 "2024-01-29T13:17:26Z")

</div>

Hello, I would like to upgrade my fleet server running on a windows server from Elastic 8.10.2 to Elastic 8.11.3. I run the upgrade through the UI from Fleet-\>Agents page. When I do this, I get the following 2 errors: …

---

## [401 Unauthorized](https://discuss.elastic.co/t/401-unauthorized/351806)

<div class="topic-metadata">

**Author:** [@Lukasz\_Skrzat](https://discuss.elastic.co/u/Lukasz_Skrzat)\
**Replies:** 1\
**Last updated:** [January 27, 2024, 2:50pm UTC](https://discuss.elastic.co/t/401-unauthorized/351806 "2024-01-27T14:50:49Z")

</div>

Hi i trying connect my kubernetes agent to elastic-stack using fleet token but after deployment have error "Failed to connect to backoff(elasticsearch(https://elasticsearch.logging-stack.svc.cluster.local:9200)): 401 U…

---

## [My Agent not send Logs, Kibana Healthy Green](https://discuss.elastic.co/t/my-agent-not-send-logs-kibana-healthy-green/351600)

<div class="topic-metadata">

**Author:** [@aguskhohar](https://discuss.elastic.co/u/aguskhohar)\
**Replies:** 3\
**Last updated:** [January 26, 2024, 1:10pm UTC](https://discuss.elastic.co/t/my-agent-not-send-logs-kibana-healthy-green/351600 "2024-01-26T13:10:40Z")

</div>

Hi Guys, Could you please to help me, my kibana is green but my agent not send log. fyi, my elastic : http://localhost:9200 my kibana : http://10.xxx.xxx.xxx:5601 my fleet server : http://10.xxx.xxx.xxx:8220

---

## [Looking for advice on a use case for NetFlow](https://discuss.elastic.co/t/looking-for-advice-on-a-use-case-for-netflow/351422)

<div class="topic-metadata">

**Author:** [@tonitones](https://discuss.elastic.co/u/tonitones)\
**Replies:** 3\
**Last updated:** [January 26, 2024, 2:47am UTC](https://discuss.elastic.co/t/looking-for-advice-on-a-use-case-for-netflow/351422 "2024-01-26T02:47:10Z")

</div>

Hello everyone from the elastic community! This will be my first topic here. Hoping to get some insights from everyone. I am very new to elastic. I was able to install and run elk stack on docker, thanks to the official…

---

## [Permissions to view and manage agents in fleet](https://discuss.elastic.co/t/permissions-to-view-and-manage-agents-in-fleet/351748)

<div class="topic-metadata">

**Author:** [@psdarwin](https://discuss.elastic.co/u/psdarwin)\
**Replies:** 2\
**Last updated:** [January 24, 2024, 8:52pm UTC](https://discuss.elastic.co/t/permissions-to-view-and-manage-agents-in-fleet/351748 "2024-01-24T20:52:40Z")

</div>

It used to be that you had to be superuser to even have view permissions into fleet. Is that still true? I am hoping to delegate management of fleet agents to another team, but really do not want to give them superuser…

---

## [Not able to get elastic agent system integration in the Kibana UI](https://discuss.elastic.co/t/not-able-to-get-elastic-agent-system-integration-in-the-kibana-ui/351704)

<div class="topic-metadata">

**Author:** [@Ashwani\_Shukla](https://discuss.elastic.co/u/Ashwani_Shukla)\
**Replies:** 1\
**Last updated:** [January 24, 2024, 12:50pm UTC](https://discuss.elastic.co/t/not-able-to-get-elastic-agent-system-integration-in-the-kibana-ui/351704 "2024-01-24T12:50:36Z")

</div>

I have deployed the ES and Kibana in a separate VMs and fleet server in the kibana server itself. But after adding the fleet server, there is no option for system integration to collect the logs from elastic agent in Kib…

---

## [\[elastic\_agent\]\[error\] Cannot checkin in with fleet-server, retrying](https://discuss.elastic.co/t/elastic-agent-error-cannot-checkin-in-with-fleet-server-retrying/351595)

<div class="topic-metadata">

**Author:** [@AnkurYogi](https://discuss.elastic.co/u/AnkurYogi)\
**Replies:** 1\
**Last updated:** [January 23, 2024, 8:34am UTC](https://discuss.elastic.co/t/elastic-agent-error-cannot-checkin-in-with-fleet-server-retrying/351595 "2024-01-23T08:34:58Z")

</div>

Hi everyone All my agents are showing offline and I am not sure why. Here are some logs and info to start the discussion..! { "log.level": "info", "@timestamp": "2024-01-23T06:21:39.097Z", "message": "ApiKey fail…

---

## [Seeking Guidance on Implementing Retry Mechanism and Handling Delayed PubSub Messages in Bulk Document Operations](https://discuss.elastic.co/t/seeking-guidance-on-implementing-retry-mechanism-and-handling-delayed-pubsub-messages-in-bulk-document-operations/351627)

<div class="topic-metadata">

**Author:** [@Ivelin\_Yanev](https://discuss.elastic.co/u/Ivelin_Yanev)\
**Replies:** 3\
**Last updated:** [January 24, 2024, 7:27am UTC](https://discuss.elastic.co/t/seeking-guidance-on-implementing-retry-mechanism-and-handling-delayed-pubsub-messages-in-bulk-document-operations/351627 "2024-01-24T07:27:04Z")

</div>

Dear all, I hope this message finds you well. I am currently immersed in the implementation of bulk operations for handling documents. The process involves receiving PubSub messages and dynamically generating correspon…

---

## [Monitoring specific processes via Elastic Agent?](https://discuss.elastic.co/t/monitoring-specific-processes-via-elastic-agent/350037)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 3\
**Last updated:** [January 23, 2024, 11:31pm UTC](https://discuss.elastic.co/t/monitoring-specific-processes-via-elastic-agent/350037 "2024-01-23T23:31:21Z")

</div>

Does anyone have a good method for monitoring that specific processes are running, even if said processes are not in the top N cpu/ram usage group? The System integration lets you monitor the Top N processes. You can li…

---

## [Kubernetes deployed Elastic Agent is looped in beat restart](https://discuss.elastic.co/t/kubernetes-deployed-elastic-agent-is-looped-in-beat-restart/350707)

<div class="topic-metadata">

**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\
**Replies:** 4\
**Last updated:** [January 23, 2024, 7:58am UTC](https://discuss.elastic.co/t/kubernetes-deployed-elastic-agent-is-looped-in-beat-restart/350707 "2024-01-23T07:58:07Z")

</div>

Hello, I tried to deploy Fleet-managed Elastic Agent with Kubernetes Integration into RedHat OpenShift. When deploying an agent policy update using Fleet, the beats are caught up in a restart loop: Agent version: beats…

---

## [Error when enrolloning Fleet on ELK](https://discuss.elastic.co/t/error-when-enrolloning-fleet-on-elk/349983)

<div class="topic-metadata">

**Author:** [@Ellery](https://discuss.elastic.co/u/Ellery)\
**Replies:** 1\
**Last updated:** [January 23, 2024, 1:25am UTC](https://discuss.elastic.co/t/error-when-enrolloning-fleet-on-elk/349983 "2024-01-23T01:25:34Z")

</div>

Hello, I hope you can help me. I have the following issue: I have successfully installed Elasticsearch and Kibana. Now I'm installing Fleet, but no matter what I do, I encounter the following error: The instalation it's …

---

## [Fleet serve wrong elastic Address](https://discuss.elastic.co/t/fleet-serve-wrong-elastic-address/350332)

<div class="topic-metadata">

**Author:** [@Lukasz\_Skrzat](https://discuss.elastic.co/u/Lukasz_Skrzat)\
**Replies:** 1\
**Last updated:** [January 23, 2024, 1:11am UTC](https://discuss.elastic.co/t/fleet-serve-wrong-elastic-address/350332 "2024-01-23T01:11:42Z")

</div>

HI Installed new ECK instance with fleet server, but i change namespace from Default to logging-stack Changed in fleet configs addresses. Now install new agents to kubernetes integration with fleet token but after …

---

## [When does compression\_level change?](https://discuss.elastic.co/t/when-does-compression-level-change/350659)

<div class="topic-metadata">

**Author:** [@slash24](https://discuss.elastic.co/u/slash24)\
**Replies:** 1\
**Last updated:** [January 23, 2024, 1:04am UTC](https://discuss.elastic.co/t/when-does-compression-level-change/350659 "2024-01-23T01:04:39Z")

</div>

We're on Elastic 8.8.1 and about to upgrade to 8.11.3. Since we have alot of issues with Elastic Agents on our Windows-boxes, esp. when endpoint or agent is being reloaded but also with high cpuutilization (mostly due t…

---

## [Elastic agent installation: 502 Bad Gateway](https://discuss.elastic.co/t/elastic-agent-installation-502-bad-gateway/351013)

<div class="topic-metadata">

**Author:** [@elhog03](https://discuss.elastic.co/u/elhog03)\
**Replies:** 1\
**Last updated:** [January 22, 2024, 4:44pm UTC](https://discuss.elastic.co/t/elastic-agent-installation-502-bad-gateway/351013 "2024-01-22T16:44:32Z")

</div>

I try to install the Elastic agent using the following command (as I do not want the publish our token here, I write "OMITTED" instead of the token): sudo ./elastic-agent install --url=https://172.16.201.8:443 --enrollm…

---

## [Does the '--ca-sha256' command line option for Elastic Agent actually work?](https://discuss.elastic.co/t/does-the-ca-sha256-command-line-option-for-elastic-agent-actually-work/351397)

<div class="topic-metadata">

**Author:** [@digital-thought](https://discuss.elastic.co/u/digital-thought)\
**Replies:** 1\
**Last updated:** [January 22, 2024, 4:41pm UTC](https://discuss.elastic.co/t/does-the-ca-sha256-command-line-option-for-elastic-agent-actually-work/351397 "2024-01-22T16:41:07Z")

</div>

I have a self-managed fleet server that has a self-signed certificate on it. I can successfully enrol an agent if I use the following command line options: --certificate-authorities=elasticsearch-ca.pem --fleet-server-…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=23)

[Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=25)
