# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=41 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 42 --- ## [Data streams vs ILM when using Fleet](https://discuss.elastic.co/t/data-streams-vs-ilm-when-using-fleet/324017)
**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\ **Replies:** 3\ **Last updated:** [January 26, 2023, 2:59pm UTC](https://discuss.elastic.co/t/data-streams-vs-ilm-when-using-fleet/324017 "2023-01-26T14:59:34Z")
Hello, We are moving away from Beats towards the Centralised Elastic Agent / Fleet but struggling to understand the concept behind how the new approach is meant to work with ILM. We have multiple infrastructures to pull… --- ## [Elastic Agent - Import only the latest data using Journald integration](https://discuss.elastic.co/t/elastic-agent-import-only-the-latest-data-using-journald-integration/324097)
**Author:** [@daniele.saccon](https://discuss.elastic.co/u/daniele.saccon)\ **Replies:** 0\ **Last updated:** [January 27, 2023, 9:53am UTC](https://discuss.elastic.co/t/elastic-agent-import-only-the-latest-data-using-journald-integration/324097 "2023-01-27T09:53:16Z")
Hello everybody, I'm using the Journald integration for the Elastic Agent. Is it possible to import only the last 7 days of the Journald instead of all the data? If it is possible how can I do? Thanks Daniele --- ## [MetricBeat 8.6.0 - error getting connection to system bus: dial unix /var/run/dbus/system\_bus\_socket: connect: no such file or directory](https://discuss.elastic.co/t/metricbeat-8-6-0-error-getting-connection-to-system-bus-dial-unix-var-run-dbus-system-bus-socket-connect-no-such-file-or-directory/323618)
**Author:** [@Ednei\_Rodrigues](https://discuss.elastic.co/u/Ednei_Rodrigues)\ **Replies:** 3\ **Last updated:** [January 27, 2023, 9:23am UTC](https://discuss.elastic.co/t/metricbeat-8-6-0-error-getting-connection-to-system-bus-dial-unix-var-run-dbus-system-bus-socket-connect-no-such-file-or-directory/323618 "2023-01-27T09:23:24Z")
Hello, how are you doing ? So, I've installed metricbeat in my ubuntu server ( Ubuntu 20.04.5 LTS ) and I enabled three modules: root@SBG5PC4:~# metricbeat modules list Enabled: mysql nginx system I have been working… --- ## [How to disable the traceparent and tracestate headers](https://discuss.elastic.co/t/how-to-disable-the-traceparent-and-tracestate-headers/324058)
**Author:** [@e03c5fccb551b6833a65](https://discuss.elastic.co/u/e03c5fccb551b6833a65)\ **Replies:** 0\ **Last updated:** [January 26, 2023, 6:23pm UTC](https://discuss.elastic.co/t/how-to-disable-the-traceparent-and-tracestate-headers/324058 "2023-01-26T18:23:08Z")
One of our services connects with a bank, and it's not allowing any requests with the tracepearent, tracestate header. I tried using the property use\_elastic\_traceparent\_header as false, but still I see the headers in t… --- ## [How many of you are using Otel for your K8S apps on Elastic vs docker?](https://discuss.elastic.co/t/how-many-of-you-are-using-otel-for-your-k8s-apps-on-elastic-vs-docker/324056)
**Author:** [@Bahubali\_Shetti](https://discuss.elastic.co/u/Bahubali_Shetti)\ **Replies:** 0\ **Last updated:** [January 26, 2023, 6:02pm UTC](https://discuss.elastic.co/t/how-many-of-you-are-using-otel-for-your-k8s-apps-on-elastic-vs-docker/324056 "2023-01-26T18:02:33Z")
OpenTelemetry and Elastic: An unbeatable combination for observability | Elastic Blog covers the baseline of what's being supported. Curious what people's experiences are on Otel with Elastic. Any interesting examples, e… --- ## [How to identify if a Windows PC requires a restart?](https://discuss.elastic.co/t/how-to-identify-if-a-windows-pc-requires-a-restart/323887)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 0\ **Last updated:** [January 25, 2023, 7:08am UTC](https://discuss.elastic.co/t/how-to-identify-if-a-windows-pc-requires-a-restart/323887 "2023-01-25T07:08:20Z")
Hi, I am using Elastic agent 7.17.4 to monitor the windows machines. Is there any OOB feature to identify if a Windows machine requires a restart after a patch/software update? --- ## [Elastic agent integration stuck on upgrade | fleet affected](https://discuss.elastic.co/t/elastic-agent-integration-stuck-on-upgrade-fleet-affected/322447)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 4\ **Last updated:** [January 23, 2023, 4:44pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-stuck-on-upgrade-fleet-affected/322447 "2023-01-23T16:44:10Z")
any idea how to stop the update process or update it properly --- ## [Remove monitoring for some specific URL in on application - Elastic APM](https://discuss.elastic.co/t/remove-monitoring-for-some-specific-url-in-on-application-elastic-apm/323685)
**Author:** [@Harhsa\_vardhan](https://discuss.elastic.co/u/Harhsa_vardhan)\ **Replies:** 1\ **Last updated:** [January 22, 2023, 4:48pm UTC](https://discuss.elastic.co/t/remove-monitoring-for-some-specific-url-in-on-application-elastic-apm/323685 "2023-01-22T16:48:33Z")
Trying to implement APM newly in one of my test cluster. My test application has some 6+ URL's which starts with same domain, I need to remove monitoring for some specific URL in on application. Is there any option to … --- ## [Grey out "elastic-agent" in login items in Ventura](https://discuss.elastic.co/t/grey-out-elastic-agent-in-login-items-in-ventura/323578)
**Author:** [@jadi](https://discuss.elastic.co/u/jadi)\ **Replies:** 0\ **Last updated:** [January 20, 2023, 9:49am UTC](https://discuss.elastic.co/t/grey-out-elastic-agent-in-login-items-in-ventura/323578 "2023-01-20T09:49:02Z")
Hey guys, Anyone managed to hide/grey out the "elastic-agent" that appears in login items in macOS Ventura? I created a service management profile with the bundleID "co.elastic.elastic-agent" but it's still doesn't wor… --- ## [Elastic fleet server fails to install after 8.6.0](https://discuss.elastic.co/t/elastic-fleet-server-fails-to-install-after-8-6-0/323063)
**Author:** [@PublicName](https://discuss.elastic.co/u/PublicName)\ **Replies:** 6\ **Last updated:** [January 19, 2023, 10:39pm UTC](https://discuss.elastic.co/t/elastic-fleet-server-fails-to-install-after-8-6-0/323063 "2023-01-19T22:39:23Z")
"Fleet Server - Waiting on fleet-server input to be added to default policy","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2023-01-12T12:57:55.988-0800","log.origin":{"file.name":"cmd/enroll\_cmd.go","file.lin… --- ## [Fleet server stuck upgrading 8.5.3 -\> 8.6.0](https://discuss.elastic.co/t/fleet-server-stuck-upgrading-8-5-3-8-6-0/323204)
**Author:** [@rossw](https://discuss.elastic.co/u/rossw)\ **Replies:** 5\ **Last updated:** [January 19, 2023, 8:01pm UTC](https://discuss.elastic.co/t/fleet-server-stuck-upgrading-8-5-3-8-6-0/323204 "2023-01-19T20:01:33Z")
Our fleet server runs on our kibana server, with about 20 agents connected. We upgrade our Elastic cluster from 8.5.3 to 8.6.0 and the upgrade popped up in the fleet UI just fine. Selected the fleet server for the upgra… --- ## [Custom log integration with Text & json file](https://discuss.elastic.co/t/custom-log-integration-with-text-json-file/323492)
**Author:** [@praveen\_raju](https://discuss.elastic.co/u/praveen_raju)\ **Replies:** 0\ **Last updated:** [January 19, 2023, 9:39am UTC](https://discuss.elastic.co/t/custom-log-integration-with-text-json-file/323492 "2023-01-19T09:39:51Z")
Hi, We have text files which are getting created on Windows VM's and Linux VM's in certain location. Here is the sample text file which is getting created. So, we i would like to get the log and parse into different fie… --- ## [On-premises fleet server install: es bad\_certificate](https://discuss.elastic.co/t/on-premises-fleet-server-install-es-bad-certificate/323090)
**Author:** [@dms6978](https://discuss.elastic.co/u/dms6978)\ **Replies:** 2\ **Last updated:** [January 18, 2023, 12:27am UTC](https://discuss.elastic.co/t/on-premises-fleet-server-install-es-bad-certificate/323090 "2023-01-18T00:27:29Z")
I am installing the Fleet server in the on-premises environment. It's all connected, so fleet server is completed with healthy. Then, Elasticsearch is sending an warning called bad\_certificate. Is it because I sent ht… --- ## [How to add specific windows services, applications, webservers for monitoring purpose](https://discuss.elastic.co/t/how-to-add-specific-windows-services-applications-webservers-for-monitoring-purpose/322094)
**Author:** [@rakeshsid01](https://discuss.elastic.co/u/rakeshsid01)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 2:25pm UTC](https://discuss.elastic.co/t/how-to-add-specific-windows-services-applications-webservers-for-monitoring-purpose/322094 "2023-01-17T14:25:41Z")
We have added windows servers or agents in fleet for monitoring checking alerts. We want to add specific services . And we want to alert when it is down how can we achieve this. --- ## [Status of elastic agent dont change updating to Healthy](https://discuss.elastic.co/t/status-of-elastic-agent-dont-change-updating-to-healthy/322706)
**Author:** [@qwerasdf](https://discuss.elastic.co/u/qwerasdf)\ **Replies:** 1\ **Last updated:** [January 17, 2023, 2:19pm UTC](https://discuss.elastic.co/t/status-of-elastic-agent-dont-change-updating-to-healthy/322706 "2023-01-17T14:19:07Z")
I define elastic agent policy with logstash output but when i install agent on assets, status of agents remains on updating but when output set to elasticsearch I dont have any problem and status is Healthy? Please Help… --- ## [Where is Filestream integration?](https://discuss.elastic.co/t/where-is-filestream-integration/323245)
**Author:** [@Guillaume\_Bouchez](https://discuss.elastic.co/u/Guillaume_Bouchez)\ **Replies:** 1\ **Last updated:** [January 16, 2023, 3:58pm UTC](https://discuss.elastic.co/t/where-is-filestream-integration/323245 "2023-01-16T15:58:25Z")
I'm Using fleet and elastic-agent integration for collecting logs, and I recently discovered a warning from elastic\_agent.filebeat, stating that logs inputs are deprecated and to use filetream inputs instead. Fine with… --- ## [Elastic Agent Container - Secrets Management](https://discuss.elastic.co/t/elastic-agent-container-secrets-management/323067)
**Author:** [@MoreCowBell](https://discuss.elastic.co/u/MoreCowBell)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 11:28pm UTC](https://discuss.elastic.co/t/elastic-agent-container-secrets-management/323067 "2023-01-12T23:28:10Z")
I'm looking to further harden the security of passing secrets into the elastic agent configuration at runtime. I'm wondering if the following would work. Scenario: Integration: Azure Active Directory Sensitive Values: … --- ## [Error making http request](https://discuss.elastic.co/t/error-making-http-request/323056)
**Author:** [@Myagmarsuren-a](https://discuss.elastic.co/u/Myagmarsuren-a)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 7:19pm UTC](https://discuss.elastic.co/t/error-making-http-request/323056 "2023-01-12T19:19:09Z")
I have issue. I added elastic-agent as fleet server. Also i installed elasticsearch and kibana using docker-compose. Then i wanted to monitor my kubernetes cluster with elastic agent with kubernetes integration in it. Wh… --- ## [Cisco IOS Elastic-agent no longer retrieving data](https://discuss.elastic.co/t/cisco-ios-elastic-agent-no-longer-retrieving-data/323050)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 0\ **Last updated:** [January 12, 2023, 5:31pm UTC](https://discuss.elastic.co/t/cisco-ios-elastic-agent-no-longer-retrieving-data/323050 "2023-01-12T17:31:23Z")
After the recent update to the Cisco 1.11.0 elastic agent, data is no longer being processed from the connected Cisco devices. In version 1.10.0 this was working. When looking at netstat on the device that should be rec… --- ## [Docker and System Logs/Metrics from container-based Agent](https://discuss.elastic.co/t/docker-and-system-logs-metrics-from-container-based-agent/322679)
**Author:** [@litronics](https://discuss.elastic.co/u/litronics)\ **Replies:** 13\ **Last updated:** [January 12, 2023, 10:27am UTC](https://discuss.elastic.co/t/docker-and-system-logs-metrics-from-container-based-agent/322679 "2023-01-12T10:27:52Z")
Hi, I am pretty new to the ELK Stack and have some trouble getting detailed metrics from a docker based agent. The Stack is running on also as docker container and after days playing around with TLS certificates I have… --- ## [Bucket split group terms data coming in missing through filebeat](https://discuss.elastic.co/t/bucket-split-group-terms-data-coming-in-missing-through-filebeat/322869)
**Author:** [@devdev7711](https://discuss.elastic.co/u/devdev7711)\ **Replies:** 0\ **Last updated:** [January 11, 2023, 6:12am UTC](https://discuss.elastic.co/t/bucket-split-group-terms-data-coming-in-missing-through-filebeat/322869 "2023-01-11T06:12:56Z")
We are using filebeat to read logs we have 2 logs entry count but when we are doing metrics bucket split group aggregation that time these 2 records are not visible those are coming in missing. below is the log det… --- ## [Gsub with regex](https://discuss.elastic.co/t/gsub-with-regex/322756)
**Author:** [@searchtastic](https://discuss.elastic.co/u/searchtastic)\ **Replies:** 1\ **Last updated:** [January 10, 2023, 4:32pm UTC](https://discuss.elastic.co/t/gsub-with-regex/322756 "2023-01-10T16:32:26Z")
Hi, My regex is matching my condition on my ingest pipeline, however I am struggling to wrap my found string with quotes for the replacement. expression. "gsub": { "field": "message", "pattern": "\\b\[0-… --- ## [Custom Log integration multiple pipelines](https://discuss.elastic.co/t/custom-log-integration-multiple-pipelines/322485)
**Author:** [@searchtastic](https://discuss.elastic.co/u/searchtastic)\ **Replies:** 7\ **Last updated:** [January 9, 2023, 3:43pm UTC](https://discuss.elastic.co/t/custom-log-integration-multiple-pipelines/322485 "2023-01-09T15:43:39Z")
I have a custom integration setup with Elastic agent. At the moment I have a directory with several log files containing quite different data. I can't use the same pipeline so I would like to reference another pipeline.… --- ## [SentinelOne Integration - Missing Logs](https://discuss.elastic.co/t/sentinelone-integration-missing-logs/322336)
**Author:** [@clintonm9](https://discuss.elastic.co/u/clintonm9)\ **Replies:** 1\ **Last updated:** [January 9, 2023, 9:54am UTC](https://discuss.elastic.co/t/sentinelone-integration-missing-logs/322336 "2023-01-09T09:54:43Z")
I have set up SentinelOne Integration and have enabled all of the log collections. I see logs coming in, but there is not much detail. Does anyone know if more details like you see in S1 console should be ingested? --- ## [Agent stuck on updating after install](https://discuss.elastic.co/t/agent-stuck-on-updating-after-install/322641)
**Author:** [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Replies:** 0\ **Last updated:** [January 6, 2023, 9:37pm UTC](https://discuss.elastic.co/t/agent-stuck-on-updating-after-install/322641 "2023-01-06T21:37:45Z")
Continuing the discussion from Agent stuck on updating but still send index: We are also seeing this. We have Fleet deployed in ECK. We have 2 fleet servers listed in Kibana, one url is the k8s internal Cluster DNS FQ… --- ## [AbuseCH and enrichment on custom pipeline](https://discuss.elastic.co/t/abusech-and-enrichment-on-custom-pipeline/322480)
**Author:** [@ramiwashere](https://discuss.elastic.co/u/ramiwashere)\ **Replies:** 2\ **Last updated:** [January 6, 2023, 1:29pm UTC](https://discuss.elastic.co/t/abusech-and-enrichment-on-custom-pipeline/322480 "2023-01-06T13:29:20Z")
Hi there, I have a simple question about abuseCH integration and field enrichment of abuseCH to an other index. When a create my enrich policy, I don't have an error: PUT /\_enrich/policy/abusechurl-enrich-policy { … --- ## [Auditbeat installation failed](https://discuss.elastic.co/t/auditbeat-installation-failed/322507)
**Author:** [@freemankevin](https://discuss.elastic.co/u/freemankevin)\ **Replies:** 7\ **Last updated:** [January 6, 2023, 2:55am UTC](https://discuss.elastic.co/t/auditbeat-installation-failed/322507 "2023-01-06T02:55:41Z")
error message：x509: certificate signed by unknown authority \[root@efk ~\]# curl -f https://localhost:8220/api/status -k {"name":"fleet-server","status":"HEALTHY"}\[root@efk ~\]# \[root@efk ~\]# \[root@efk ~\]# \[root@efk ~\]# cu… --- ## [Help with kibana and elastic-agent no work](https://discuss.elastic.co/t/help-with-kibana-and-elastic-agent-no-work/322477)
**Author:** [@hernani33](https://discuss.elastic.co/u/hernani33)\ **Replies:** 4\ **Last updated:** [January 5, 2023, 11:32am UTC](https://discuss.elastic.co/t/help-with-kibana-and-elastic-agent-no-work/322477 "2023-01-05T11:32:55Z")
i have elasticsearch kibana and elastic-agent installed ok. but elastic-agent not work in kibana, I ALWAYS SAY LISTENING FOR AGENT WHEN I GO TO CLICK ADD AGENT. IN STEP 3 IN INTEGRATION POLICIE CONFIRM AGENT ENROLLMENT,… --- ## [Fail to install Elastic-Agent](https://discuss.elastic.co/t/fail-to-install-elastic-agent/322495)
**Author:** [@pntmky](https://discuss.elastic.co/u/pntmky)\ **Replies:** 8\ **Last updated:** [January 5, 2023, 7:46am UTC](https://discuss.elastic.co/t/fail-to-install-elastic-agent/322495 "2023-01-05T07:46:33Z")
First of all, I installed Elastic Agent by DEB successfully, but I realize that cannot upgrade, so I uninstall Elastic Agent and remove installation layout of Elastic Agent. And now when I install by Linux Tar, it fai… --- ## [Identify unhealthy elastic agents](https://discuss.elastic.co/t/identify-unhealthy-elastic-agents/322508)
**Author:** [@Sanjaya\_Chathuranga](https://discuss.elastic.co/u/Sanjaya_Chathuranga)\ **Replies:** 0\ **Last updated:** [January 5, 2023, 5:07am UTC](https://discuss.elastic.co/t/identify-unhealthy-elastic-agents/322508 "2023-01-05T05:07:43Z")
Hi Some Fleet Elastic agents have become unhealthy in our environment and we have to manually identify them. can we configure fleet elastic agent to send us an alert if it becomes unhealthy? the purpose is to identify … [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=40) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=42)