# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=43 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 44 --- ## [Ingest pipeline - Override datastream](https://discuss.elastic.co/t/ingest-pipeline-override-datastream/321163)
**Author:** [@jeff.diademi](https://discuss.elastic.co/u/jeff.diademi)\ **Replies:** 2\ **Last updated:** [December 14, 2022, 6:48am UTC](https://discuss.elastic.co/t/ingest-pipeline-override-datastream/321163 "2022-12-14T06:48:20Z")
Today, I'm ingesting logs from kubernetes containers pods using elastic agent kubernetes integration. It works fine. Now, I have a use case which is the following: Some specific logs records need to be ingested in anot… --- ## [Elastic agent on EKS unhealthy](https://discuss.elastic.co/t/elastic-agent-on-eks-unhealthy/321155)
**Author:** [@wh1sss](https://discuss.elastic.co/u/wh1sss)\ **Replies:** 0\ **Last updated:** [December 13, 2022, 5:34pm UTC](https://discuss.elastic.co/t/elastic-agent-on-eks-unhealthy/321155 "2022-12-13T17:34:14Z")
Hi everyone, I created a cluster on the elastic cloud and I'm using the "Kubernetes Security", "Kubernetes" and "Elastic APM" integrations. The agents are being installed directly on the EKS cluster on AWS with the m… --- ## [Another Cloudflare integration issue](https://discuss.elastic.co/t/another-cloudflare-integration-issue/320085)
**Author:** [@ethhack](https://discuss.elastic.co/u/ethhack)\ **Replies:** 12\ **Last updated:** [December 13, 2022, 1:41pm UTC](https://discuss.elastic.co/t/another-cloudflare-integration-issue/320085 "2022-12-13T13:41:03Z")
Similar to this post for which I see no resolution anywhere, I have an issue with the Cloudflare logpull integration erroring out about the 168h maximum: "message":"Error while processing http request: failed to execute… --- ## [Enrollment Token deletion](https://discuss.elastic.co/t/enrollment-token-deletion/320335)
**Author:** [@FabianEidner](https://discuss.elastic.co/u/FabianEidner)\ **Replies:** 10\ **Last updated:** [December 12, 2022, 5:57pm UTC](https://discuss.elastic.co/t/enrollment-token-deletion/320335 "2022-12-12T17:57:24Z")
Hello, im struggle to delete old enrollment tokens under: Kibana -\> Fleet -\> Enrollment Tokens Neither in the ui nor via the api i'm able to delete them. In the ui they just are flagged as inactive and via the api "ap… --- ## [Integration node needed for Fleetserver on ECE](https://discuss.elastic.co/t/integration-node-needed-for-fleetserver-on-ece/320943)
**Author:** [@stobbe](https://discuss.elastic.co/u/stobbe)\ **Replies:** 1\ **Last updated:** [December 12, 2022, 2:40am UTC](https://discuss.elastic.co/t/integration-node-needed-for-fleetserver-on-ece/320943 "2022-12-12T02:40:01Z")
Hello, Found this in the documentation that when you deploy a fleetserver on ECE, you also need to start an Integration node. This is not needed for the regular elastic stack. Can anybody explain this a little more… --- ## [Timeout error when downloading the artifacts in elastic-agent from kibana UI](https://discuss.elastic.co/t/timeout-error-when-downloading-the-artifacts-in-elastic-agent-from-kibana-ui/320266)
**Author:** [@perea870724](https://discuss.elastic.co/u/perea870724)\ **Replies:** 2\ **Last updated:** [December 11, 2022, 4:54pm UTC](https://discuss.elastic.co/t/timeout-error-when-downloading-the-artifacts-in-elastic-agent-from-kibana-ui/320266 "2022-12-11T16:54:57Z")
Good morning, I am trying to update the elastic-agent from the kibana UI interface, but it is giving me a timeout error when downloading the artifacts, how can I increase the package download timeout? --- ## [Is there an easy way to manage custom ingest pipeline and custom fields for Elastic Agent Integrations?](https://discuss.elastic.co/t/is-there-an-easy-way-to-manage-custom-ingest-pipeline-and-custom-fields-for-elastic-agent-integrations/319682)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 7:01pm UTC](https://discuss.elastic.co/t/is-there-an-easy-way-to-manage-custom-ingest-pipeline-and-custom-fields-for-elastic-agent-integrations/319682 "2022-12-08T19:01:37Z")
Hello, We are trying to find a way to manage custom ingest pipelines and fields/mappings for our integrations. As an example, we are using the Cisco Duo integration, this integration has the following ingest pipelines. … --- ## [How to resolve IP to hostname comming from Nginx access logs using nginx integration?](https://discuss.elastic.co/t/how-to-resolve-ip-to-hostname-comming-from-nginx-access-logs-using-nginx-integration/320788)
**Author:** [@DUGi](https://discuss.elastic.co/u/DUGi)\ **Replies:** 0\ **Last updated:** [December 8, 2022, 12:31pm UTC](https://discuss.elastic.co/t/how-to-resolve-ip-to-hostname-comming-from-nginx-access-logs-using-nginx-integration/320788 "2022-12-08T12:31:19Z")
Hello, I have a question regarding nginx integration - access-log. I set it up and everything is working but I want to change source.ip to hostname. I'm using Fleet with agent and nginx integration. I added to Collec… --- ## [API for configuring Fleet Server settings?](https://discuss.elastic.co/t/api-for-configuring-fleet-server-settings/318879)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 4:18am UTC](https://discuss.elastic.co/t/api-for-configuring-fleet-server-settings/318879 "2022-12-08T04:18:23Z")
Is there a programmatic way to set the values for Fleet Server as shown in this image here? I'm ok with command line tools, restful api, or some other automated service. There's a lot of elastic documentation, but I… --- ## [Agent stuck on updating but still send index](https://discuss.elastic.co/t/agent-stuck-on-updating-but-still-send-index/319391)
**Author:** [@xondeeptry](https://discuss.elastic.co/u/xondeeptry)\ **Replies:** 1\ **Last updated:** [December 8, 2022, 3:53am UTC](https://discuss.elastic.co/t/agent-stuck-on-updating-but-still-send-index/319391 "2022-12-08T03:53:12Z")
I'm just enroll new window fleet everything is fine data received by logstash and stored in our cluster but agent stuck on updating in fleet. When i get agent status everything is healthy unless fleet-server stuck on re… --- ## [Elastic agent is unhealthy](https://discuss.elastic.co/t/elastic-agent-is-unhealthy/320664)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [December 8, 2022, 2:40am UTC](https://discuss.elastic.co/t/elastic-agent-is-unhealthy/320664 "2022-12-08T02:40:43Z")
Hi all, I have a case when after i enroll the fleet server to Elasticsearch. It become health for a while then became unhealthy. I checked the log then it said this: {"@timestamp":"2022-12-07T08:58:09.831566388Z","ag… --- ## [USB Detection Using Elastic-agent or some other beat](https://discuss.elastic.co/t/usb-detection-using-elastic-agent-or-some-other-beat/320710)
**Author:** [@Mohsin\_Ashraf](https://discuss.elastic.co/u/Mohsin_Ashraf)\ **Replies:** 0\ **Last updated:** [December 7, 2022, 6:25pm UTC](https://discuss.elastic.co/t/usb-detection-using-elastic-agent-or-some-other-beat/320710 "2022-12-07T18:25:57Z")
Hi, Can we detect USB when it plugs into the system on windows or Linux using elastic-agent or some other beats? --- ## [Ingest Pipeline for custom logs](https://discuss.elastic.co/t/ingest-pipeline-for-custom-logs/320380)
**Author:** [@shuuny-matrix](https://discuss.elastic.co/u/shuuny-matrix)\ **Replies:** 6\ **Last updated:** [December 7, 2022, 5:42pm UTC](https://discuss.elastic.co/t/ingest-pipeline-for-custom-logs/320380 "2022-12-07T17:42:37Z")
Hi, I am ingesting the standards syslogs using the elastic agent "custom logs" integration. I am trying to parse the logs before indexing and for that I am using ingest pipeline. I have two processors for that: Grok an… --- ## [Install Integration on one or multiple endpoints?](https://discuss.elastic.co/t/install-integration-on-one-or-multiple-endpoints/320511)
**Author:** [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Replies:** 0\ **Last updated:** [December 6, 2022, 1:23am UTC](https://discuss.elastic.co/t/install-integration-on-one-or-multiple-endpoints/320511 "2022-12-06T01:23:49Z")
Hello, How do we know if an Integration should be installed on one endpoint of multiple? Microsoft 365 Integration, if pushed to multiple endpoints, would be redundant and duplicate the data right? Elastic Defend,… --- ## [Provision ILM policy for elastic agent streams](https://discuss.elastic.co/t/provision-ilm-policy-for-elastic-agent-streams/320348)
**Author:** [@PaulusTM](https://discuss.elastic.co/u/PaulusTM)\ **Replies:** 0\ **Last updated:** [December 2, 2022, 10:04am UTC](https://discuss.elastic.co/t/provision-ilm-policy-for-elastic-agent-streams/320348 "2022-12-02T10:04:58Z")
Hi folks, I'm new to Elastic Agent configuration and running the latest ECK build on Kubernetes. While I really like to visibility Fleet offers, it seems I'm unable to provision custom ILM policies like I can with Beat… --- ## [How to properly monitor containerized databases?](https://discuss.elastic.co/t/how-to-properly-monitor-containerized-databases/320401)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 0\ **Last updated:** [December 3, 2022, 12:50am UTC](https://discuss.elastic.co/t/how-to-properly-monitor-containerized-databases/320401 "2022-12-03T00:50:21Z")
I'm in the the middle of testing how well deploying a MariaDB Galera cluster per app works in a Docker Swarm stack. The idea being that we can tweak each Galera cluster to fit each individual apps needs, have them be hi… --- ## [Adding fortinet FortiGate firewall as agent to fleet](https://discuss.elastic.co/t/adding-fortinet-fortigate-firewall-as-agent-to-fleet/320362)
**Author:** [@Med2](https://discuss.elastic.co/u/Med2)\ **Replies:** 4\ **Last updated:** [December 2, 2022, 2:38pm UTC](https://discuss.elastic.co/t/adding-fortinet-fortigate-firewall-as-agent-to-fleet/320362 "2022-12-02T14:38:36Z")
Hi, I've installed an elastic agent server and added to it several windows machines and linux servers using the enrollment tokens. Now that I've added the "Fortinet FortiGate Firewall Logs" integration in kibana and af… --- ## [CloudWatch Integration pulling logs from multiple log groups](https://discuss.elastic.co/t/cloudwatch-integration-pulling-logs-from-multiple-log-groups/320288)
**Author:** [@salt\_ninja](https://discuss.elastic.co/u/salt_ninja)\ **Replies:** 0\ **Last updated:** [December 1, 2022, 7:26pm UTC](https://discuss.elastic.co/t/cloudwatch-integration-pulling-logs-from-multiple-log-groups/320288 "2022-12-01T19:26:38Z")
Hi team, I'm trying to use the CloudWatch Integration to pull logs from AWS CloudWatch to Elastic. However, I have only managed to pull logs from a single log group instead of multiple log groups. I have tried to limit… --- ## [Newly set up elastic agent does not gather anything](https://discuss.elastic.co/t/newly-set-up-elastic-agent-does-not-gather-anything/320257)
**Author:** [@SirMuffington](https://discuss.elastic.co/u/SirMuffington)\ **Replies:** 0\ **Last updated:** [December 1, 2022, 2:41pm UTC](https://discuss.elastic.co/t/newly-set-up-elastic-agent-does-not-gather-anything/320257 "2022-12-01T14:41:56Z")
I newly setup my Elastic Agent with Fleet. I clicked thru the interface and it always can't read the logs, variables etc... Is this normal for a new setup or did I mess something up from the start? --- ## [Elastic Agent - problems following the documentation, stumbled upon dead links and more](https://discuss.elastic.co/t/elastic-agent-problems-following-the-documentation-stumbled-upon-dead-links-and-more/319495)
**Author:** [@SirMuffington](https://discuss.elastic.co/u/SirMuffington)\ **Replies:** 13\ **Last updated:** [December 1, 2022, 2:26pm UTC](https://discuss.elastic.co/t/elastic-agent-problems-following-the-documentation-stumbled-upon-dead-links-and-more/319495 "2022-12-01T14:26:56Z")
In the documentation for setting up Elastic Agent the following is stated: Kibana user with All privileges on Fleet and Integrations. Since many Integrations assets are shared across spaces, users need the Kibana privi… --- ## [Wrong timestamp and timezone in Custom Log integration](https://discuss.elastic.co/t/wrong-timestamp-and-timezone-in-custom-log-integration/320151)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 0\ **Last updated:** [November 30, 2022, 1:04pm UTC](https://discuss.elastic.co/t/wrong-timestamp-and-timezone-in-custom-log-integration/320151 "2022-11-30T13:04:53Z")
Hi, I have Raspberry Pi’s in different timezones writing logs to a Syslog server. The logs from the Syslog server are being collected by Elastic Agent and are correctly stored in the system.syslog Index Logs look like: … --- ## [\[Integrations\] F5 Integration, Radware Integration Out Of Date](https://discuss.elastic.co/t/integrations-f5-integration-radware-integration-out-of-date/319241)
**Author:** [@cmendez92](https://discuss.elastic.co/u/cmendez92)\ **Replies:** 2\ **Last updated:** [November 29, 2022, 5:53pm UTC](https://discuss.elastic.co/t/integrations-f5-integration-radware-integration-out-of-date/319241 "2022-11-29T17:53:09Z")
F5 and Radware integrations are deprecated. Let me explain, it is not normal that they have an intermediate parser in JS (without posibility of change fron integration), it is practically better to let the message throug… --- ## [LiteSpeed Webserver Monitor](https://discuss.elastic.co/t/litespeed-webserver-monitor/320047)
**Author:** [@acosta353](https://discuss.elastic.co/u/acosta353)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 1:25pm UTC](https://discuss.elastic.co/t/litespeed-webserver-monitor/320047 "2022-11-29T13:25:05Z")
Hello, Is there any way to monitor (filebeat and most important with metricbeats) a litespeed Webserver? I would like to have some graphs with statistics of number of requests, and other things as we have in Apache and… --- ## [Custom Ingest Pipeline](https://discuss.elastic.co/t/custom-ingest-pipeline/319316)
**Author:** [@acosta353](https://discuss.elastic.co/u/acosta353)\ **Replies:** 2\ **Last updated:** [November 29, 2022, 1:22pm UTC](https://discuss.elastic.co/t/custom-ingest-pipeline/319316 "2022-11-29T13:22:27Z")
Hello, I'm new to Elastic, and I'm trying to search how to configure properly a custom ingest pipeline to Apache integration. In fact, I need to add some different groks and time formats so that some logs can be parsed… --- ## [Consuming Windows events with agent v8.4, getting error: EventHandles returned error The parameter is incorrect](https://discuss.elastic.co/t/consuming-windows-events-with-agent-v8-4-getting-error-eventhandles-returned-error-the-parameter-is-incorrect/319995)
**Author:** [@Michael\_Hyatt](https://discuss.elastic.co/u/Michael_Hyatt)\ **Replies:** 0\ **Last updated:** [November 29, 2022, 6:37am UTC](https://discuss.elastic.co/t/consuming-windows-events-with-agent-v8-4-getting-error-eventhandles-returned-error-the-parameter-is-incorrect/319995 "2022-11-29T06:37:40Z")
Had Elastic agent 8.4 running consuming windows events using the System integration and the ingest stops with this warning showing right before the ingest stops: I am really keen to know what can be done to debug it fur… --- ## [Unable to make Kafka Integration to work](https://discuss.elastic.co/t/unable-to-make-kafka-integration-to-work/319932)
**Author:** [@natbronislavska](https://discuss.elastic.co/u/natbronislavska)\ **Replies:** 1\ **Last updated:** [November 29, 2022, 5:51am UTC](https://discuss.elastic.co/t/unable-to-make-kafka-integration-to-work/319932 "2022-11-29T05:51:53Z")
Hello Everyone, I have Elastic Search with fleet, elastic-agent and Kibana, all in version 8.4.3. I am trying to work with integrations and I have successfully enabled few of them. However, I have trouble enabling kafka… --- ## [Fleet output](https://discuss.elastic.co/t/fleet-output/319834)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 0\ **Last updated:** [November 25, 2022, 3:42pm UTC](https://discuss.elastic.co/t/fleet-output/319834 "2022-11-25T15:42:17Z")
Is it possible to prevent Kibana from creating a default Fleet output? In my kibana.yml file that preconfigures Kibana before it gets installed I have created a custom fleet output doing the following: xpack.fleet.outp… --- ## [Fleet enroll with --ca-sha256](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891)
**Author:** [@adrien\_moreau](https://discuss.elastic.co/u/adrien_moreau)\ **Replies:** 0\ **Last updated:** [November 27, 2022, 8:43pm UTC](https://discuss.elastic.co/t/fleet-enroll-with-ca-sha256/319891 "2022-11-27T20:43:37Z")
Hello, I am trying to enroll an elastic-agent to a self managed fleet server using the --ca-sha256 parameter. I have setup the fleet server security following this guide: If I try to enroll the agent using the follo… --- ## [Java exclude framework related classes](https://discuss.elastic.co/t/java-exclude-framework-related-classes/319940)
**Author:** [@APandey](https://discuss.elastic.co/u/APandey)\ **Replies:** 0\ **Last updated:** [November 28, 2022, 11:28am UTC](https://discuss.elastic.co/t/java-exclude-framework-related-classes/319940 "2022-11-28T11:28:14Z")
Hello everyone, How can we filter out framework related classes from the final stack trace that we get for a transaction? For reference, { "stacktrace" : \[ { "exclude\_from\_gro… --- ## [Unable to initialize fleet v8.5](https://discuss.elastic.co/t/unable-to-initialize-fleet-v8-5/319905)
**Author:** [@theacodes](https://discuss.elastic.co/u/theacodes)\ **Replies:** 1\ **Last updated:** [November 28, 2022, 7:31am UTC](https://discuss.elastic.co/t/unable-to-initialize-fleet-v8-5/319905 "2022-11-28T07:31:27Z")
I upgraded from 8.4 to 8.5 and now getting this error [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=42) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=44)