# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=3 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 4 --- ## [Logstash elastic integration](https://discuss.elastic.co/t/logstash-elastic-integration/383926)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 3\ **Last updated:** [December 9, 2025, 4:29pm UTC](https://discuss.elastic.co/t/logstash-elastic-integration/383926 "2025-12-09T16:29:54Z")
Hello, I make use of Elastic Fleet. I configured a logstash output for several integrations. The logstash pipeline contains the elastic\_integration filter, so elastic ingest pipelines are also executed by logstash. I a… --- ## [Upgrade agent on Fleet server](https://discuss.elastic.co/t/upgrade-agent-on-fleet-server/383902)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 1\ **Last updated:** [December 5, 2025, 6:55pm UTC](https://discuss.elastic.co/t/upgrade-agent-on-fleet-server/383902 "2025-12-05T18:55:19Z")
Hello, I’ve successfully updated most of the Elasticsearch stack to the latest version 9.2.2 I’m having difficulty understanding how I upgrade the agent on the Fleet server; I can’t update the agent from the Fleet secti… --- ## [Elastic Agent memory consumption](https://discuss.elastic.co/t/elastic-agent-memory-consumption/383034)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 3\ **Last updated:** [December 4, 2025, 7:02pm UTC](https://discuss.elastic.co/t/elastic-agent-memory-consumption/383034 "2025-12-04T19:02:49Z")
Is there any ways to limit the memory used by elastic-agent. Elastic Agent and Endpoint are consuming around 2GB memory. This is too high for a tool like elastic agent. Any help/tips for reducing memory usage is highly a… --- ## [X509: certificate signed by unknown authority , elastic agent + Tenable SC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-elastic-agent-tenable-sc/383835)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 3\ **Last updated:** [December 3, 2025, 11:31am UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-elastic-agent-tenable-sc/383835 "2025-12-03T11:31:39Z")
dear elastic community Im working on integrating Tenable Security Center via elastic agent , and getting x509: certificate signed by unknown , can please advise what actions to check also if the certificate signed by u… --- ## [Migrating from beats to the agent - best approach?](https://discuss.elastic.co/t/migrating-from-beats-to-the-agent-best-approach/383822)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 1\ **Last updated:** [December 2, 2025, 8:38pm UTC](https://discuss.elastic.co/t/migrating-from-beats-to-the-agent-best-approach/383822 "2025-12-02T20:38:27Z")
Greetings! I am somewhat new to Elasticsearch and have been tasked with migrating from beats to the Elastic agent. We just finished migrating to Elastic cloud so this is the next thing we want to tackle to modernize. Fo… --- ## [Windows Event Logs Showing as Filebeat — Expected Winlogbeat](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746)
**Author:** [@shalev\_aviram](https://discuss.elastic.co/u/shalev_aviram)\ **Replies:** 2\ **Last updated:** [November 30, 2025, 3:40pm UTC](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746 "2025-11-30T15:40:20Z")
Hi everyone, new here (: I have a question regarding Windows logs collected via Elastic Agent + Fleet. In some integrations (like windows - sysmon..) where I expect to see agent.type = winlogbeat, I instead see agent.t… --- ## [Elastic Agent metric endpoint autodiscovery in Kubernetes](https://discuss.elastic.co/t/elastic-agent-metric-endpoint-autodiscovery-in-kubernetes/383640)
**Author:** [@ilyazh](https://discuss.elastic.co/u/ilyazh)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 10:09am UTC](https://discuss.elastic.co/t/elastic-agent-metric-endpoint-autodiscovery-in-kubernetes/383640 "2025-11-27T10:09:45Z")
Hello everyone, we are looking into monitoring Kubernetes Clusters with Elastic Agents using the Kubernetes Integration. We are using Fleet to manage our Elastic Agents. We are able to collect metrics from kubelet api, … --- ## [License inquiry regarding CSPM](https://discuss.elastic.co/t/license-inquiry-regarding-cspm/383674)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 3\ **Last updated:** [November 26, 2025, 4:56pm UTC](https://discuss.elastic.co/t/license-inquiry-regarding-cspm/383674 "2025-11-26T16:56:19Z")
I wanted to make sure if it was applicable or not to purchase individual features instead of the whole license. I was interested in trying CSPM integration only, without purchasing the whole Enterprise license. Thank yo… --- ## [Active Directory Entity Analytics integration](https://discuss.elastic.co/t/active-directory-entity-analytics-integration/382910)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 1\ **Last updated:** [November 26, 2025, 11:47am UTC](https://discuss.elastic.co/t/active-directory-entity-analytics-integration/382910 "2025-11-26T11:47:53Z")
Hi everyone, I’m having a problem with the Active Directory Entity Analytics integration. Everything used to work perfectly — and it still works fine on another cluster where I’m still running version 0.15. However, on… --- ## [Some agent API keys get invalidated then deleted](https://discuss.elastic.co/t/some-agent-api-keys-get-invalidated-then-deleted/383631)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [November 25, 2025, 4:00am UTC](https://discuss.elastic.co/t/some-agent-api-keys-get-invalidated-then-deleted/383631 "2025-11-25T04:00:50Z")
I noticed errors “Unable to authenticate - apikey not found”. For a few apikeys. They are frequently repeated. This is an Elastic cloud hosted stack. These seem to have started with the prior version update, then mor… --- ## [Elastic Agent high CPU Usage](https://discuss.elastic.co/t/elastic-agent-high-cpu-usage/383578)
**Author:** [@hdrkhls](https://discuss.elastic.co/u/hdrkhls)\ **Replies:** 0\ **Last updated:** [November 21, 2025, 8:13am UTC](https://discuss.elastic.co/t/elastic-agent-high-cpu-usage/383578 "2025-11-21T08:13:56Z")
Hi there, Elastic Stack : 9.0.3 Elastic Agent: 9.04 Im already install elastic-agent standalone on my postgresql server using postgresql module integration on kibana, and there is high cpu usage, which is make my post… --- ## [Adding Fleet/Agent to existing ECK managed cluster](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556)
**Author:** [@smashley](https://discuss.elastic.co/u/smashley)\ **Replies:** 1\ **Last updated:** [November 20, 2025, 5:45pm UTC](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556 "2025-11-20T17:45:15Z")
I’m having trouble trying to add Fleet and Agent to one of our existing elastic clusters (EDIT: es, kibana, agent all 9.1.5, in ECK managed cluster in an AWS EKS cluster). I was successfully able to do this on a newly bu… --- ## [Confused by --fleet-server-es-cert\* flags](https://discuss.elastic.co/t/confused-by-fleet-server-es-cert-flags/383546)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 3\ **Last updated:** [November 20, 2025, 3:48pm UTC](https://discuss.elastic.co/t/confused-by-fleet-server-es-cert-flags/383546 "2025-11-20T15:48:10Z")
So can someone clarify for me how these flags are used: --fleet-server-es-cert\*, --fleet-server-es-ca, --fleet-server-client-auth ? For example, let’s say I ran this command on my linux server 192.168.0.2 to turn it int… --- ## [Issue enrolling into fleet](https://discuss.elastic.co/t/issue-enrolling-into-fleet/383470)
**Author:** [@f4n-1nh1b1t10n](https://discuss.elastic.co/u/f4n-1nh1b1t10n)\ **Replies:** 16\ **Last updated:** [November 19, 2025, 4:26pm UTC](https://discuss.elastic.co/t/issue-enrolling-into-fleet/383470 "2025-11-19T16:26:58Z")
Hello, I seem to stumble on the issue of enrolling my agent securely into fleet. i’ve tried the FAQ where they suggest to install the agent first, and then enroll it into fleet (upgrading the agent to a fleet server wi… --- ## [Error connecting with local Package registry](https://discuss.elastic.co/t/error-connecting-with-local-package-registry/383442)
**Author:** [@Vishnu\_J](https://discuss.elastic.co/u/Vishnu_J)\ **Replies:** 0\ **Last updated:** [November 14, 2025, 10:59am UTC](https://discuss.elastic.co/t/error-connecting-with-local-package-registry/383442 "2025-11-14T10:59:10Z")
I am not able to connect Kibana with my locally deployed Elastic Package registry in an air gapped environment. I am getting this error in the kibana logs error: RegistryConnectionError: Error connecting to package regi… --- ## [How to correctly report VM hostname when Elastic Agent runs in a Podman container](https://discuss.elastic.co/t/how-to-correctly-report-vm-hostname-when-elastic-agent-runs-in-a-podman-container/383336)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 11:56am UTC](https://discuss.elastic.co/t/how-to-correctly-report-vm-hostname-when-elastic-agent-runs-in-a-podman-container/383336 "2025-11-12T11:56:23Z")
Hi everyone, I’m trying to collect package installation/removal events using the system\_audit.package stream on Rocky Linux 9.6. I’m running Elastic Agent 9.1.3 (elastic-agent-complete) inside a Podman container, manag… --- ## [Issues Getting Node to Rejoin Cluster after Renewing Certificates](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 4\ **Last updated:** [November 11, 2025, 2:58pm UTC](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296 "2025-11-11T14:58:16Z")
I’ve been working through the challenges of renewing my http and transport certificates on one of my nodes. Both were renewed using the same CA that was used prior. Although the elasticsearch service is now starting su… --- ## [Elastic Agent 9.1.3 – system\_audit.package on Rocky Linux 9.6 – no DNF install/remove events](https://discuss.elastic.co/t/elastic-agent-9-1-3-system-audit-package-on-rocky-linux-9-6-no-dnf-install-remove-events/383289)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 9\ **Last updated:** [November 11, 2025, 1:28pm UTC](https://discuss.elastic.co/t/elastic-agent-9-1-3-system-audit-package-on-rocky-linux-9-6-no-dnf-install-remove-events/383289 "2025-11-11T13:28:10Z")
Hi, I’m trying to collect package installation/removal events using the system\_audit.package stream on Rocky Linux 9.6. I’m running Elastic Agent 9.1.3 (elastic-agent-complete) in a Podman container. image: \`\`docker.e… --- ## [How could I change the "agent.name" in a Elastic Agent instance? 8.18](https://discuss.elastic.co/t/how-could-i-change-the-agent-name-in-a-elastic-agent-instance-8-18/383271)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 4\ **Last updated:** [November 11, 2025, 1:09pm UTC](https://discuss.elastic.co/t/how-could-i-change-the-agent-name-in-a-elastic-agent-instance-8-18/383271 "2025-11-11T13:09:57Z")
Once I’ve used the version 8.5 and we could overide the “agent.name” as well as add some tags in the documents generated by the service by editing the “mtricbeat.yaml” file. But as of now the document no longer exists an… --- ## [How to define dynamic templates for geo\_point in a custom Integration (Fleet + elastic-package)?](https://discuss.elastic.co/t/how-to-define-dynamic-templates-for-geo-point-in-a-custom-integration-fleet-elastic-package/382524)
**Author:** [@B\_Grimm](https://discuss.elastic.co/u/B_Grimm)\ **Replies:** 2\ **Last updated:** [November 11, 2025, 12:39pm UTC](https://discuss.elastic.co/t/how-to-define-dynamic-templates-for-geo-point-in-a-custom-integration-fleet-elastic-package/382524 "2025-11-11T12:39:40Z")
How to define dynamic templates for geo\_point in a custom Integration (Fleet + elastic-package)? Context I’m building a custom Elastic Integration with elastic-package (Fleet-managed data streams). Some events contain … --- ## ["precondition failed: EOF" error in apm-server logs on kubernetes](https://discuss.elastic.co/t/precondition-failed-eof-error-in-apm-server-logs-on-kubernetes/383196)
**Author:** [@amritansh](https://discuss.elastic.co/u/amritansh)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 9:16am UTC](https://discuss.elastic.co/t/precondition-failed-eof-error-in-apm-server-logs-on-kubernetes/383196 "2025-11-04T09:16:57Z")
Hi I am facing a "precondition failed: EOF" error on my elastic setup on kubernetes while configuring elastic java apm agent. I checked the service connectivity and it seems to be fine. Attaching the apm-server logs … --- ## [Integrating fortigate firewall to elastic](https://discuss.elastic.co/t/integrating-fortigate-firewall-to-elastic/382949)
**Author:** [@phumlani](https://discuss.elastic.co/u/phumlani)\ **Replies:** 2\ **Last updated:** [October 28, 2025, 8:49pm UTC](https://discuss.elastic.co/t/integrating-fortigate-firewall-to-elastic/382949 "2025-10-28T20:49:52Z")
I am required to pull logs from the firewall(fortigate), and Office365. I have registered the application on microsoft AZURE for office365 and assigned permissions(Office365 management API(ActivityFeed.Read, ActivityFeed… --- ## [Extending Tomcat integration to collect additional JMX metrics (e.g., java\_lang\_OperatingSystem, oracle\_ucp\_admin)](https://discuss.elastic.co/t/extending-tomcat-integration-to-collect-additional-jmx-metrics-e-g-java-lang-operatingsystem-oracle-ucp-admin/382984)
**Author:** [@DIPTOPOL](https://discuss.elastic.co/u/DIPTOPOL)\ **Replies:** 0\ **Last updated:** [October 26, 2025, 3:07pm UTC](https://discuss.elastic.co/t/extending-tomcat-integration-to-collect-additional-jmx-metrics-e-g-java-lang-operatingsystem-oracle-ucp-admin/382984 "2025-10-26T15:07:28Z")
I am currently exploring the Tomcat integration using the Elastic Agent. From my observations, the default metrics collected through the JMX Prometheus exporter do not include all available data. For example, metric sets… --- ## [Elastic Agent offline caching of events](https://discuss.elastic.co/t/elastic-agent-offline-caching-of-events/382925)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 6\ **Last updated:** [October 23, 2025, 7:03pm UTC](https://discuss.elastic.co/t/elastic-agent-offline-caching-of-events/382925 "2025-10-23T19:03:31Z")
If we have a fleet agent installed and then that agent goes offline with no “line of sight” to the elasticsearch/fleet server, how are events handled that are captured through integrations. Say you had an ubuntu host wit… --- ## [Configuring Elastic Agent to trust Fleet Server's certificate (eck-stack Helm Chart)](https://discuss.elastic.co/t/configuring-elastic-agent-to-trust-fleet-servers-certificate-eck-stack-helm-chart/382893)
**Author:** [@CitizenSteak](https://discuss.elastic.co/u/CitizenSteak)\ **Replies:** 0\ **Last updated:** [October 22, 2025, 2:55pm UTC](https://discuss.elastic.co/t/configuring-elastic-agent-to-trust-fleet-servers-certificate-eck-stack-helm-chart/382893 "2025-10-22T14:55:44Z")
I deployed eck-operator and I’m deploying eck-stack via the helm chart eck-stack-0.16.0 I’m getting an error in Elastic Agent logs : {"log.level":"error","@timestamp":"2025-10-22T13:11:03.233Z","log.origin":{"function"… --- ## [K8s Integration custom configuration](https://discuss.elastic.co/t/k8s-integration-custom-configuration/382832)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 0\ **Last updated:** [October 20, 2025, 9:58am UTC](https://discuss.elastic.co/t/k8s-integration-custom-configuration/382832 "2025-10-20T09:58:51Z")
Hi All, How do I custom a configuration for Integration to support a old Filebeat configuration? Ex. - id: kube-logs-logstash-multiline data\_stream: dataset: kubernetes.container\_logs condition: … --- ## [Kubernetes Integration Policy Parser Configuration](https://discuss.elastic.co/t/kubernetes-integration-policy-parser-configuration/382766)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 1\ **Last updated:** [October 18, 2025, 8:05am UTC](https://discuss.elastic.co/t/kubernetes-integration-policy-parser-configuration/382766 "2025-10-18T08:05:50Z")
Hello All, Regarding the Parser configuration of integration policy, if I have too many multiline pattern for each name. Let say, I have this below for each log | Agent Policy | Multiline Pattern | Targ… --- ## [MS Defender for Endpoint integration](https://discuss.elastic.co/t/ms-defender-for-endpoint-integration/381572)
**Author:** [@bbreer](https://discuss.elastic.co/u/bbreer)\ **Replies:** 2\ **Last updated:** [October 16, 2025, 3:17pm UTC](https://discuss.elastic.co/t/ms-defender-for-endpoint-integration/381572 "2025-10-16T15:17:38Z")
After upgrading to 8.19.2, the MS Defender for Endpoint integration said Reauthorization required. It worked fine before the upgrade. When I click on that integration and then click on the Assets tab, it says the ins… --- ## [Migrate Filebeat to use Elastic Agent as a log conllector](https://discuss.elastic.co/t/migrate-filebeat-to-use-elastic-agent-as-a-log-conllector/382473)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 1\ **Last updated:** [October 15, 2025, 9:38am UTC](https://discuss.elastic.co/t/migrate-filebeat-to-use-elastic-agent-as-a-log-conllector/382473 "2025-10-15T09:38:19Z")
Hi All, We currently have Filebeat running on our cluster via Helm, and we plan to migrate to Elastic Agent as our log collector. Our goal is to decommission Filebeat once Elastic Agent can fully replicate its log colle… --- ## [\[9.1.4\] Elastic-agent doesn't gather tls info with synthetics integration](https://discuss.elastic.co/t/9-1-4-elastic-agent-doesnt-gather-tls-info-with-synthetics-integration/382699)
**Author:** [@Dth\_Revan](https://discuss.elastic.co/u/Dth_Revan)\ **Replies:** 0\ **Last updated:** [October 14, 2025, 11:29am UTC](https://discuss.elastic.co/t/9-1-4-elastic-agent-doesnt-gather-tls-info-with-synthetics-integration/382699 "2025-10-14T11:29:31Z")
Hello! Recently I updated my cluster and all of the Elastic-agents from 8.17.4 - - → 8.19.4 - - → 9.1.4 (and then updated a couple of agents to version 9.1.5 just for test) and it appeared that they stopped gathering (a… [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=2) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=4)