# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=25 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 26 --- ## [Elastic agent sending to second node if first node unreachable](https://discuss.elastic.co/t/elastic-agent-sending-to-second-node-if-first-node-unreachable/351564)
**Author:** [@TIT](https://discuss.elastic.co/u/TIT)\ **Replies:** 1\ **Last updated:** [January 22, 2024, 4:37pm UTC](https://discuss.elastic.co/t/elastic-agent-sending-to-second-node-if-first-node-unreachable/351564 "2024-01-22T16:37:10Z")
in fleet outputs settings if modifiying the hosts section and add multiple hosts will that mean that agent will send data the the second hosts only when the first one is unreachable , or data will be sent to the both … --- ## [Elastic Agent support RHEL 6](https://discuss.elastic.co/t/elastic-agent-support-rhel-6/351372)
**Author:** [@sajmeister](https://discuss.elastic.co/u/sajmeister)\ **Replies:** 2\ **Last updated:** [January 19, 2024, 12:33pm UTC](https://discuss.elastic.co/t/elastic-agent-support-rhel-6/351372 "2024-01-19T12:33:55Z")
Hiya, We are using Elastic Agent version 8.10.2 and can see it works on RHEL 7 but not on RHEL 6. The Support Matrix also confirms that. We then tried an older version of the Elastic Agent v7.17 on RHEL 6 and that als… --- ## [How does elastic agent configure filebeat](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187)
**Author:** [@mbby](https://discuss.elastic.co/u/mbby)\ **Replies:** 9\ **Last updated:** [January 19, 2024, 7:17am UTC](https://discuss.elastic.co/t/how-does-elastic-agent-configure-filebeat/351187 "2024-01-19T07:17:22Z")
Hi, I've installed an agent and added a custom log integration to the policy. It's working but I'm wondering if there's some documentation which tells me: How does the agent configure filebeat? I searched in the filesy… --- ## [Drop event in procesor result in no records](https://discuss.elastic.co/t/drop-event-in-procesor-result-in-no-records/351352)
**Author:** [@Ruben\_Bahntje](https://discuss.elastic.co/u/Ruben_Bahntje)\ **Replies:** 2\ **Last updated:** [January 18, 2024, 1:29pm UTC](https://discuss.elastic.co/t/drop-event-in-procesor-result-in-no-records/351352 "2024-01-18T13:29:07Z")
I am using Fleet to configure agent policies for windows servers. I configure to get several security events 4624, 4625, 4771 and drop events when LogonType = 3 I ve configure procesor like this: drop\_event: when: … --- ## [Automating Sophos Central Agent Policies Integration via Python](https://discuss.elastic.co/t/automating-sophos-central-agent-policies-integration-via-python/351349)
**Author:** [@bl4ck-m33k4t](https://discuss.elastic.co/u/bl4ck-m33k4t)\ **Replies:** 1\ **Last updated:** [January 18, 2024, 1:21pm UTC](https://discuss.elastic.co/t/automating-sophos-central-agent-policies-integration-via-python/351349 "2024-01-18T13:21:58Z")
Hi everyone, I'm currently working on automating the deployment of Sophos Central Agent policies using Python. My goal is to create policies and add integrations programmatically. However, I'm facing challenges with the… --- ## [Filebeat Components ignores logging level](https://discuss.elastic.co/t/filebeat-components-ignores-logging-level/351260)
**Author:** [@Marc\_Wolff](https://discuss.elastic.co/u/Marc_Wolff)\ **Replies:** 0\ **Last updated:** [January 17, 2024, 11:18am UTC](https://discuss.elastic.co/t/filebeat-components-ignores-logging-level/351260 "2024-01-17T11:18:35Z")
Hi all, We have an eck environment in a onprem k8s cluster with elasticsearch, kibana, logstash (http input) and elastic-agent as a standalone for the container logs. Version for all is 8.11.4 This is fine so far. Our… --- ## [Json processor Parsing Issue Workaround](https://discuss.elastic.co/t/json-processor-parsing-issue-workaround/351208)
**Author:** [@vishnu.a](https://discuss.elastic.co/u/vishnu.a)\ **Replies:** 1\ **Last updated:** [January 17, 2024, 10:53am UTC](https://discuss.elastic.co/t/json-processor-parsing-issue-workaround/351208 "2024-01-17T10:53:49Z")
Hello I'm trying to parse a field using the Json processor. the input is similar to the following: {"json": { \\"field1\\":\\"...\\", \\"field2\\":\\"...\\", ... , \\"Message\\":\\"\\\", ... , \\"fieldn\\":\\"...\\" } The… --- ## [Azure: Normalizing Array Fields](https://discuss.elastic.co/t/azure-normalizing-array-fields/351184)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [January 16, 2024, 4:13pm UTC](https://discuss.elastic.co/t/azure-normalizing-array-fields/351184 "2024-01-16T16:13:12Z")
Hello, I am using Elastic's Azure Integration to collect AD Audit logs. Everything is working as expected but I find the schema logic to be hard to work with. The managed ingest pipeline runs a script to map out nested… --- ## [\[Error\] fleet-server failed: context canceled](https://discuss.elastic.co/t/error-fleet-server-failed-context-canceled/351096)
**Author:** [@Cliff\_ln](https://discuss.elastic.co/u/Cliff_ln)\ **Replies:** 1\ **Last updated:** [January 16, 2024, 3:42pm UTC](https://discuss.elastic.co/t/error-fleet-server-failed-context-canceled/351096 "2024-01-16T15:42:07Z")
Hello, I'm trying to upgrade my Elastic cluster from version 8.10.4 to 8.11.1. I encountered issues during the upgrade of Fleet. The upgrade steps involve deleting the existing Fleet server and Agent policies, then crea… --- ## [Redirect Elastic Agent to new Fleet Server](https://discuss.elastic.co/t/redirect-elastic-agent-to-new-fleet-server/350310)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 3\ **Last updated:** [January 16, 2024, 3:36pm UTC](https://discuss.elastic.co/t/redirect-elastic-agent-to-new-fleet-server/350310 "2024-01-16T15:36:59Z")
I have about 1000 elastic agents currently connected to a Fleet server that is also my Kibana server. I'd like to migrate the devices to a new Fleet server to improve the performance of my Kibana server. Can I migrate … --- ## [Ensuring Document Ordering in Bulk Ingestion](https://discuss.elastic.co/t/ensuring-document-ordering-in-bulk-ingestion/350972)
**Author:** [@Ivelin\_Yanev](https://discuss.elastic.co/u/Ivelin_Yanev)\ **Replies:** 11\ **Last updated:** [January 15, 2024, 2:41pm UTC](https://discuss.elastic.co/t/ensuring-document-ordering-in-bulk-ingestion/350972 "2024-01-15T14:41:04Z")
Hi everyone, I'm currently working on implementing bulk operations for documents. In my scenario, I receive PubSub messages and generate corresponding Elasticsearch documents using the data from these PubSub messages. I… --- ## [HowTo reconfigure an ElasticAgent with an invalid Fleet-URL](https://discuss.elastic.co/t/howto-reconfigure-an-elasticagent-with-an-invalid-fleet-url/350600)
**Author:** [@m3sos](https://discuss.elastic.co/u/m3sos)\ **Replies:** 4\ **Last updated:** [January 15, 2024, 7:23am UTC](https://discuss.elastic.co/t/howto-reconfigure-an-elasticagent-with-an-invalid-fleet-url/350600 "2024-01-15T07:23:03Z")
My elastic agents are running in a kubernetes cluster (daemon set). For debugging purposes I configured a fleet server url pointing to a wiremock instance (pod only) running temporarily in the cluster too. After debuggi… --- ## [Elastic Agent](https://discuss.elastic.co/t/elastic-agent/350581)
**Author:** [@Marcus\_Berglund](https://discuss.elastic.co/u/Marcus_Berglund)\ **Replies:** 3\ **Last updated:** [January 14, 2024, 9:59am UTC](https://discuss.elastic.co/t/elastic-agent/350581 "2024-01-14T09:59:51Z")
Hi, My goal is to collect system metrics for a server e.g CPU, Disk etc. I have installed the elastic agent on the server and it show up as healthy in fleet server but there are no metrics. Do I really need to install m… --- ## [Elastic Agent and index names](https://discuss.elastic.co/t/elastic-agent-and-index-names/350985)
**Author:** [@wrender1](https://discuss.elastic.co/u/wrender1)\ **Replies:** 5\ **Last updated:** [January 13, 2024, 1:21pm UTC](https://discuss.elastic.co/t/elastic-agent-and-index-names/350985 "2024-01-13T13:21:30Z")
I'm deploying the Elastic Agent in standalone on Kubernetes. I've got he default yaml file, but I'm having a hard time with the index naming that it creates. It is a little unclear to me from the documentation. Do the i… --- ## [Elastic Agent failing to parse valid condition functions](https://discuss.elastic.co/t/elastic-agent-failing-to-parse-valid-condition-functions/349579)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 8\ **Last updated:** [January 12, 2024, 1:34am UTC](https://discuss.elastic.co/t/elastic-agent-failing-to-parse-valid-condition-functions/349579 "2024-01-12T01:34:46Z")
Hi, I'm having an issue where if I try to run elastic-agent inspect with a policy that defines a condition with a function, I get an error, even if the function is valid. Elastic Agent 8.11.3 Example: Use the Kuberne… --- ## [Elastic APM Javagent + Elastic search](https://discuss.elastic.co/t/elastic-apm-javagent-elastic-search/350805)
**Author:** [@RavaliJ](https://discuss.elastic.co/u/RavaliJ)\ **Replies:** 8\ **Last updated:** [January 11, 2024, 8:25pm UTC](https://discuss.elastic.co/t/elastic-apm-javagent-elastic-search/350805 "2024-01-11T20:25:44Z")
Hi, I am using elastic-apm-agent-1.45.0.jar to instrument a java spring boot application. I have installed Elasticsearch - 8.8.0 and apm-server-8.8.0 on my local windows machine. Made necessary basic config changes to t… --- ## [Load Balance Output to both hot nodes](https://discuss.elastic.co/t/load-balance-output-to-both-hot-nodes/350415)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 13\ **Last updated:** [January 9, 2024, 5:53pm UTC](https://discuss.elastic.co/t/load-balance-output-to-both-hot-nodes/350415 "2024-01-09T17:53:30Z")
I have two hot nodes in my cluster. I currently just have on node in the Outputs. Can I just add the 2nd node to the list of outputs? --- ## [Not able to get orchestrator.cluster.name and some info in kubernetes dashboards are not getting populated](https://discuss.elastic.co/t/not-able-to-get-orchestrator-cluster-name-and-some-info-in-kubernetes-dashboards-are-not-getting-populated/350272)
**Author:** [@Subrahmanyam\_Veerank](https://discuss.elastic.co/u/Subrahmanyam_Veerank)\ **Replies:** 1\ **Last updated:** [January 9, 2024, 4:25pm UTC](https://discuss.elastic.co/t/not-able-to-get-orchestrator-cluster-name-and-some-info-in-kubernetes-dashboards-are-not-getting-populated/350272 "2024-01-09T16:25:53Z")
i have installed fleet managed elastic agent on my kubernetes env which is already installed with kube-state-metrics but some of the dashboards are not getting populated properly and orchestrator.cluster.name is field is… --- ## [Elastic Agents in K8S ECK with ingest port for Cloudflare HTTP](https://discuss.elastic.co/t/elastic-agents-in-k8s-eck-with-ingest-port-for-cloudflare-http/350618)
**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\ **Replies:** 0\ **Last updated:** [January 9, 2024, 2:33am UTC](https://discuss.elastic.co/t/elastic-agents-in-k8s-eck-with-ingest-port-for-cloudflare-http/350618 "2024-01-09T02:33:59Z")
I have my stack running with ECK and healthy Agents being ran with integrations for kubernetes system elasticsearch and kibana. I have hit an issue with the Cloudflare HTTP integration which now requires a open port of 9… --- ## [I'm trying to build new integration](https://discuss.elastic.co/t/im-trying-to-build-new-integration/349866)
**Author:** [@zeynepyz](https://discuss.elastic.co/u/zeynepyz)\ **Replies:** 9\ **Last updated:** [January 8, 2024, 8:17am UTC](https://discuss.elastic.co/t/im-trying-to-build-new-integration/349866 "2024-01-08T08:17:29Z")
hello, i'm trying to create new integration for collecting k6 metrics via rest api. I just don't understand how can i test my integration i mean i'm trying to connect k6 but idk how can i see it? is there a command for t… --- ## [Custom UDP logs are only listening on ipv6](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497)
**Author:** [@phirestalker](https://discuss.elastic.co/u/phirestalker)\ **Replies:** 7\ **Last updated:** [January 7, 2024, 7:06am UTC](https://discuss.elastic.co/t/custom-udp-logs-are-only-listening-on-ipv6/350497 "2024-01-07T07:06:00Z")
I set up some custom UDP port integrations. I noticed that a lot of logs were not coming in, so I did netstat on the host. It turns out that it is only listening on ipv6. How can I set it to listen on both or only ipv4? --- ## [Installed Elastic-Agent cannot be removed](https://discuss.elastic.co/t/installed-elastic-agent-cannot-be-removed/350473)
**Author:** [@ghuie](https://discuss.elastic.co/u/ghuie)\ **Replies:** 9\ **Last updated:** [January 5, 2024, 6:50pm UTC](https://discuss.elastic.co/t/installed-elastic-agent-cannot-be-removed/350473 "2024-01-05T18:50:54Z")
So, I have a self-hosted ELK Stack (v. 8.11) in which I've been working for a few weeks. I've configured the certificates using the elasticsearch-certutil util and Elastic + Kibana are working fine. After that I wanted… --- ## [Elastic agent uninstall](https://discuss.elastic.co/t/elastic-agent-uninstall/349659)
**Author:** [@secsec](https://discuss.elastic.co/u/secsec)\ **Replies:** 9\ **Last updated:** [January 5, 2024, 5:53pm UTC](https://discuss.elastic.co/t/elastic-agent-uninstall/349659 "2024-01-05T17:53:32Z")
Hello, it seeemed to be simple but, im trying to uninstall elastic agent, but unfortunately no luck root@elk:/opt/elastic-agent-8.11.2-linux-x86\_64# elastic-agent uninstall Error: can only be uninstalled by executing … --- ## [Error-Failed version compatibility check with elasticsearch: tls: failed to verify certificate: x509: certificate signed by unknown authority](https://discuss.elastic.co/t/error-failed-version-compatibility-check-with-elasticsearch-tls-failed-to-verify-certificate-x509-certificate-signed-by-unknown-authority/349711)
**Author:** [@Austin1](https://discuss.elastic.co/u/Austin1)\ **Replies:** 6\ **Last updated:** [January 5, 2024, 5:26am UTC](https://discuss.elastic.co/t/error-failed-version-compatibility-check-with-elasticsearch-tls-failed-to-verify-certificate-x509-certificate-signed-by-unknown-authority/349711 "2024-01-05T05:26:41Z")
Hi all , Please help me with setting up elastic agent container! I got below error when I used podman run command followed: Error-Failed version compatibility check with elasticsearch: tls: failed to verify certificat… --- ## [How to integrate Ironscales to Elastic Cloud?](https://discuss.elastic.co/t/how-to-integrate-ironscales-to-elastic-cloud/350161)
**Author:** [@Anilkumar](https://discuss.elastic.co/u/Anilkumar)\ **Replies:** 1\ **Last updated:** [January 4, 2024, 3:01pm UTC](https://discuss.elastic.co/t/how-to-integrate-ironscales-to-elastic-cloud/350161 "2024-01-04T15:01:31Z")
Hi All, I am looking to integrate Ironscales audit logs into Elastic cloud& can't find the Integration for it. How to ingest this logs, can anyone help? --- ## [Agent Enrollment: failed to fix permissions](https://discuss.elastic.co/t/agent-enrollment-failed-to-fix-permissions/350254)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 0\ **Last updated:** [January 2, 2024, 4:00pm UTC](https://discuss.elastic.co/t/agent-enrollment-failed-to-fix-permissions/350254 "2024-01-02T16:00:43Z")
Cannot consistently replicate this issue, but it does pop up every so often. Deploying 8.10.4 Fleet-connected Agent to Oracle Linux 9: "Error: failed to fix permissions: chmod /opt/Elastic/Agent/data/elastic-agent-a92c… --- ## [Are there any issues or topics on shrinking elastic-agent's install size?](https://discuss.elastic.co/t/are-there-any-issues-or-topics-on-shrinking-elastic-agents-install-size/350099)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [December 29, 2023, 4:46pm UTC](https://discuss.elastic.co/t/are-there-any-issues-or-topics-on-shrinking-elastic-agents-install-size/350099 "2023-12-29T16:46:48Z")
Today I ran into issues trying to install, and ended up figuring out that you need at least 1.7G of disk for Agent. It had been a while since I last looked at the minimum requirements for Elastic Agent. Considering I re… --- ## [Elastic Agent successfully connect to Fleet Server but Elasticsearch did not receive data! bug](https://discuss.elastic.co/t/elastic-agent-successfully-connect-to-fleet-server-but-elasticsearch-did-not-receive-data-bug/349887)
**Author:** [@helloworld404](https://discuss.elastic.co/u/helloworld404)\ **Replies:** 1\ **Last updated:** [December 26, 2023, 4:24pm UTC](https://discuss.elastic.co/t/elastic-agent-successfully-connect-to-fleet-server-but-elasticsearch-did-not-receive-data-bug/349887 "2023-12-26T16:24:54Z")
OS lsb\_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 22.04 LTS Release: 22.04 Codename: jammy install Elastic wget -qO - https://artifacts.elastic.co/GPG-KEY-elastic… --- ## [Elastic agent not sending logs to elastic search](https://discuss.elastic.co/t/elastic-agent-not-sending-logs-to-elastic-search/349909)
**Author:** [@ramapdev](https://discuss.elastic.co/u/ramapdev)\ **Replies:** 0\ **Last updated:** [December 25, 2023, 5:18am UTC](https://discuss.elastic.co/t/elastic-agent-not-sending-logs-to-elastic-search/349909 "2023-12-25T05:18:48Z")
HI All, i am able to launch the elastic agent and fleet successfully \[ec2-user@ip-172-31-56-159 testlogs\]$ sudo /usr/bin/elastic-agent status ┌─ fleet │ └─ status: (HEALTHY) Connected └─ elastic-agent └─ status: (… --- ## [Osquery fails to return any data from Windows 10 or MACOS elastic agents](https://discuss.elastic.co/t/osquery-fails-to-return-any-data-from-windows-10-or-macos-elastic-agents/349880)
**Author:** [@hotcobra](https://discuss.elastic.co/u/hotcobra)\ **Replies:** 0\ **Last updated:** [December 23, 2023, 7:40am UTC](https://discuss.elastic.co/t/osquery-fails-to-return-any-data-from-windows-10-or-macos-elastic-agents/349880 "2023-12-23T07:40:11Z")
I can see all agents are healthy (in Security Onion 2.4.30), I attempt query and all I get back is error. I assume it's a configuration or permission issue but can't find it. Recommendations? [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=24) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=26)