# Elastic Agent **URL:** https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=8 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 9 --- ## [Installation of Elastic Agents on Non-Persistent VDI Machines](https://discuss.elastic.co/t/installation-of-elastic-agents-on-non-persistent-vdi-machines/377504)
**Author:** [@SaigaGentil](https://discuss.elastic.co/u/SaigaGentil)\ **Replies:** 1\ **Last updated:** [April 25, 2025, 2:01pm UTC](https://discuss.elastic.co/t/installation-of-elastic-agents-on-non-persistent-vdi-machines/377504 "2025-04-25T14:01:04Z")
Hello, We have a use case where we'd like to monitor hundreds of Citrix VDI desktops. Those are machines that are regularly rebooted and are built based on an image that's prebuilt... We have 1 image that is pushed to … --- ## [Is it possible to access detailed Elastic Agent metrics via API or local socket?](https://discuss.elastic.co/t/is-it-possible-to-access-detailed-elastic-agent-metrics-via-api-or-local-socket/377456)
**Author:** [@iTiago](https://discuss.elastic.co/u/iTiago)\ **Replies:** 1\ **Last updated:** [April 24, 2025, 11:51am UTC](https://discuss.elastic.co/t/is-it-possible-to-access-detailed-elastic-agent-metrics-via-api-or-local-socket/377456 "2025-04-24T11:51:57Z")
I'm investigating the possibility of connecting directly to the Elastic Agent (without going through Elasticsearch/Fleet) to monitor the behavior of each active source/configuration in real time and with greater granular… --- ## [X509 certificate signed by unknown authority error, even with --insecure flag](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-error-even-with-insecure-flag/377467)
**Author:** [@nmcc1212](https://discuss.elastic.co/u/nmcc1212)\ **Replies:** 3\ **Last updated:** [April 24, 2025, 6:57am UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-error-even-with-insecure-flag/377467 "2025-04-24T06:57:14Z")
Hi, I am installing the elastic agent with sudo ./elastic-agent install --url=https://\ --enrollment-token=\ --insecure In the output of sudo elastic-agent inspect there is ssl: renegotiation: neve… --- ## [How to change Fleet server's Elasticsearch url?](https://discuss.elastic.co/t/how-to-change-fleet-servers-elasticsearch-url/377415)
**Author:** [@kevinlin](https://discuss.elastic.co/u/kevinlin)\ **Replies:** 1\ **Last updated:** [April 23, 2025, 4:24pm UTC](https://discuss.elastic.co/t/how-to-change-fleet-servers-elasticsearch-url/377415 "2025-04-23T16:24:54Z")
sudo elastic-agent inspect ...omit... fleet: access\_api\_key: omit agent: id: omit enabled: true host: localhost:8221 hosts: - https://192.168.0.11:8220 protocol: https proxy\_disable: true server: host: 0.0.0.0 inte… --- ## [How to dynamically route FortiGate logs to different data\_stream namespaces based on devid using Logstash?](https://discuss.elastic.co/t/how-to-dynamically-route-fortigate-logs-to-different-data-stream-namespaces-based-on-devid-using-logstash/377412)
**Author:** [@wangsubo](https://discuss.elastic.co/u/wangsubo)\ **Replies:** 3\ **Last updated:** [April 23, 2025, 12:25pm UTC](https://discuss.elastic.co/t/how-to-dynamically-route-fortigate-logs-to-different-data-stream-namespaces-based-on-devid-using-logstash/377412 "2025-04-23T12:25:49Z")
Hi everyone, I’m currently working on integrating logs from two FortiGate devices into Elasticsearch via the following pipeline: FortiGate (x2) → Elastic Agent (Fortigate Integration) → Logstash (Data Stream dynamic na… --- ## [Docker image v9.0.0 could not be found](https://discuss.elastic.co/t/docker-image-v9-0-0-could-not-be-found/377436)
**Author:** [@ceVW](https://discuss.elastic.co/u/ceVW)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 12:15pm UTC](https://discuss.elastic.co/t/docker-image-v9-0-0-could-not-be-found/377436 "2025-04-23T12:15:26Z")
I'm trying to rollout a Kubernetes integration from our newly deployed Elastic 9.0.0 deployment. After applying the manifest k8s provides me with the error 'ImagePullBackOff'. The provided manifest in the integration s… --- ## [Memory leak](https://discuss.elastic.co/t/memory-leak/377174)
**Author:** [@Arun\_Kumar9](https://discuss.elastic.co/u/Arun_Kumar9)\ **Replies:** 0\ **Last updated:** [April 16, 2025, 3:31am UTC](https://discuss.elastic.co/t/memory-leak/377174 "2025-04-16T03:31:22Z")
I have integrated elastic apm in my python service. My service creates atleast 300 processes at startup, which are consumers for pulsar, i have observed the service is consuming to much memory. Service is under heavy loa… --- ## [Elastic Agent Kubernetes - Kube State Metrics for Services are empty data streams](https://discuss.elastic.co/t/elastic-agent-kubernetes-kube-state-metrics-for-services-are-empty-data-streams/377155)
**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\ **Replies:** 0\ **Last updated:** [April 15, 2025, 3:14pm UTC](https://discuss.elastic.co/t/elastic-agent-kubernetes-kube-state-metrics-for-services-are-empty-data-streams/377155 "2025-04-15T15:14:15Z")
Hi, we have an interesting issue. We use Elastic-Agent to get cluster metrics from RedHat OpenShift Monitoring kube state metrics instance. However though all metrics are ingested perfectly fine, the metricsets service… --- ## [Ruby agent is broken for more than 3 months for newer versions of ruby](https://discuss.elastic.co/t/ruby-agent-is-broken-for-more-than-3-months-for-newer-versions-of-ruby/376986)
**Author:** [@ratwithbat](https://discuss.elastic.co/u/ratwithbat)\ **Replies:** 0\ **Last updated:** [April 10, 2025, 7:11am UTC](https://discuss.elastic.co/t/ruby-agent-is-broken-for-more-than-3-months-for-newer-versions-of-ruby/376986 "2025-04-10T07:11:28Z")
Hi. Ruby agent is broken for more than 3 months. The ruby agent has a serious incompatibility issue with the new version of ruby, the community has submitted a pr for consideration but no response for almost 4 months. P… --- ## [Elastic Agent folder size growth](https://discuss.elastic.co/t/elastic-agent-folder-size-growth/376966)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 2\ **Last updated:** [April 9, 2025, 8:44pm UTC](https://discuss.elastic.co/t/elastic-agent-folder-size-growth/376966 "2025-04-09T20:44:19Z")
Hello everyone, In some companies server administrators can be very picky when requesting to install new applications which for them will increase resource consumption. In my case I have been notified that several serv… --- ## [\[Bug\] Elastic Agent reports healthy even if two integrations set up which listen on the same tcp port which doesnt work](https://discuss.elastic.co/t/bug-elastic-agent-reports-healthy-even-if-two-integrations-set-up-which-listen-on-the-same-tcp-port-which-doesnt-work/376901)
**Author:** [@fbpolar](https://discuss.elastic.co/u/fbpolar)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 1:54pm UTC](https://discuss.elastic.co/t/bug-elastic-agent-reports-healthy-even-if-two-integrations-set-up-which-listen-on-the-same-tcp-port-which-doesnt-work/376901 "2025-04-08T13:54:49Z")
When setting up two custom tcp integrations on the same elastic agent, it reports being healthy, even if the second integration doesnt work since it cannot listen on the same port as the first tcp integration. Reproduce… --- ## [Add\_kubernetes\_metadata in network flow enrich source.ip and destination.ip](https://discuss.elastic.co/t/add-kubernetes-metadata-in-network-flow-enrich-source-ip-and-destination-ip/376876)
**Author:** [@Farhad\_Salehi](https://discuss.elastic.co/u/Farhad_Salehi)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 10:36am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-in-network-flow-enrich-source-ip-and-destination-ip/376876 "2025-04-08T10:36:38Z")
i want use add\_kubernetes\_metadata for both source.ip and destination.ip but it just add source.ip information in kubernetes.pod.name and .... and i dont have any data from destinatio.ip. --- ## [Kubernetes integration not shipping container logs](https://discuss.elastic.co/t/kubernetes-integration-not-shipping-container-logs/360733)
**Author:** [@pk92](https://discuss.elastic.co/u/pk92)\ **Replies:** 3\ **Last updated:** [April 7, 2025, 8:58am UTC](https://discuss.elastic.co/t/kubernetes-integration-not-shipping-container-logs/360733 "2025-04-07T08:58:35Z")
Hi, I have a K3S cluster running and installed the Elastic Agent on a node to test the shipping of logs and metrics from the cluster. After some fiddling I got most of the metrics (with kube-state-metrics) running. My p… --- ## [How can i create file monitoring in ELK](https://discuss.elastic.co/t/how-can-i-create-file-monitoring-in-elk/376642)
**Author:** [@Mohan.k](https://discuss.elastic.co/u/Mohan.k)\ **Replies:** 1\ **Last updated:** [April 5, 2025, 9:56pm UTC](https://discuss.elastic.co/t/how-can-i-create-file-monitoring-in-elk/376642 "2025-04-05T21:56:18Z")
Can you someone suggest me to configure file monitoring in ELK side. i have elastic agent is running on my Logstash and created the integration as but data is not ingesting. Can you please help me to ingesting data sid… --- ## [Fleet-server keeping restarting 401 missing credentials](https://discuss.elastic.co/t/fleet-server-keeping-restarting-401-missing-credentials/376773)
**Author:** [@asha\_kiran](https://discuss.elastic.co/u/asha_kiran)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 10:54pm UTC](https://discuss.elastic.co/t/fleet-server-keeping-restarting-401-missing-credentials/376773 "2025-04-03T22:54:32Z")
Fleet-server pod doesn't restart but the agent keeps restarting for every minute with error missing credentials for REST/ even though the credentials are validating and fetching response from elasticsearch. Version 8.17… --- ## [Breaking changes between elastic agent 8.16.1 and 8.16.3](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219)
**Author:** [@mtr\_sw](https://discuss.elastic.co/u/mtr_sw)\ **Replies:** 9\ **Last updated:** [April 3, 2025, 2:23pm UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219 "2025-04-03T14:23:23Z")
We were successfully running the elastic agent using the image 8.16.1 in a Kubernetes replica set with the following environment variables set: FLEET\_ENROLL = "1" FLEET\_URL="\ via https" FLEET\_ENROLLME… --- ## [Agent integration custom log creation failed](https://discuss.elastic.co/t/agent-integration-custom-log-creation-failed/376729)
**Author:** [@Joey\_Visbeen](https://discuss.elastic.co/u/Joey_Visbeen)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 8:47am UTC](https://discuss.elastic.co/t/agent-integration-custom-log-creation-failed/376729 "2025-04-03T08:47:09Z")
When trying to create a custom log integration for an elastic-agent this error pops up: Datastreams matching "logs-custom.log-\*" already exist and are not managed by this package, force flag is required After some rese… --- ## [Unenrollment on already offline hosts](https://discuss.elastic.co/t/unenrollment-on-already-offline-hosts/376631)
**Author:** [@Ziyi26](https://discuss.elastic.co/u/Ziyi26)\ **Replies:** 2\ **Last updated:** [April 2, 2025, 11:20am UTC](https://discuss.elastic.co/t/unenrollment-on-already-offline-hosts/376631 "2025-04-02T11:20:06Z")
Hi there, We have a lot of Offline Elastic Agents on hosts which have not checked in for over 6 months. Per documentation, the enrollment-timeout should take care of this by automatically unenroll them and set them as i… --- ## [Testing with Filebeat vs Custom Filestream Integration](https://discuss.elastic.co/t/testing-with-filebeat-vs-custom-filestream-integration/376654)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [April 1, 2025, 10:32pm UTC](https://discuss.elastic.co/t/testing-with-filebeat-vs-custom-filestream-integration/376654 "2025-04-01T22:32:37Z")
Hello, I have custom filebeat logs and I am moving them to Elastic Agent's Custom File stream Integration. For testing everything from how the multiline is processed to the transformation to the data, was done by rinse … --- ## [Client.Timeout or context cancellation while reading body events: body.payloads.map(payload)](https://discuss.elastic.co/t/client-timeout-or-context-cancellation-while-reading-body-events-body-payloads-map-payload/376605)
**Author:** [@checo2024](https://discuss.elastic.co/u/checo2024)\ **Replies:** 0\ **Last updated:** [April 1, 2025, 12:35am UTC](https://discuss.elastic.co/t/client-timeout-or-context-cancellation-while-reading-body-events-body-payloads-map-payload/376605 "2025-04-01T00:35:16Z")
After upgrading Elasticsearch to 8.17.4 (Windows), Elastic Agent and AbuseCH 2.6.1 integration the hosts listed in Fleet show unhealthy status. The logs show the following error : elastic\_agent cel-default \[elastic\_ag… --- ## [Custom Filestream Integration - Error](https://discuss.elastic.co/t/custom-filestream-integration-error/376652)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [April 1, 2025, 5:02pm UTC](https://discuss.elastic.co/t/custom-filestream-integration-error/376652 "2025-04-01T17:02:09Z")
Hello can someone help explain this error and how to potential fix it? --- ## [Elastic Agent - ZIA integration](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 5\ **Last updated:** [March 31, 2025, 7:35pm UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336 "2025-03-31T19:35:19Z")
I recently set up ZIA integration with Elastic agent, we are getting the Datastreams but are unable to search for anything, anything comes back with no results , verified default template and all fields are keywords but… --- ## [Integration Error - OpenCTI](https://discuss.elastic.co/t/integration-error-opencti/376591)
**Author:** [@deathgame](https://discuss.elastic.co/u/deathgame)\ **Replies:** 1\ **Last updated:** [March 31, 2025, 3:20pm UTC](https://discuss.elastic.co/t/integration-error-opencti/376591 "2025-03-31T15:20:51Z")
Hello, After installing Opencti in a docker environment, I want to get the threat indicators to Elasticsearch. For that, I used the Elastic Agent integration for OpenCTI. However, this integration always shows me this … --- ## [Abuse.ch API key required but no option in integration](https://discuss.elastic.co/t/abuse-ch-api-key-required-but-no-option-in-integration/376165)
**Author:** [@daniel.velinov](https://discuss.elastic.co/u/daniel.velinov)\ **Replies:** 3\ **Last updated:** [March 31, 2025, 1:35pm UTC](https://discuss.elastic.co/t/abuse-ch-api-key-required-but-no-option-in-integration/376165 "2025-03-31T13:35:54Z")
Hello It appears that Abuse.ch can now block the Threat intel integration because of rate limiting restrictions. If we were to use API key however there is no option to place that under the integration since they requir… --- ## [Expired Certificate (agent / fleet)](https://discuss.elastic.co/t/expired-certificate-agent-fleet/376403)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 9\ **Last updated:** [March 30, 2025, 1:22pm UTC](https://discuss.elastic.co/t/expired-certificate-agent-fleet/376403 "2025-03-30T13:22:40Z")
First - this is all about a private, protected and insecure test environment! I decided to install agents with the --insecure option and since some days i found out that there's no more data received in the server. Fle… --- ## [Elastic endpoint degraded state](https://discuss.elastic.co/t/elastic-endpoint-degraded-state/376444)
**Author:** [@Jason\_Hirata](https://discuss.elastic.co/u/Jason_Hirata)\ **Replies:** 3\ **Last updated:** [March 27, 2025, 3:11am UTC](https://discuss.elastic.co/t/elastic-endpoint-degraded-state/376444 "2025-03-27T03:11:40Z")
Trying to run the unified elastic-agent 8.15.0 as ds in kubernetes, and running into the following issue. ┌─ fleet │ └─ status: (HEALTHY) Connected └─ elastic-agent ├─ status: (DEGRADED) 1 or more components/units i… --- ## [Detect Systems Type with Elastic](https://discuss.elastic.co/t/detect-systems-type-with-elastic/376436)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [March 26, 2025, 5:38pm UTC](https://discuss.elastic.co/t/detect-systems-type-with-elastic/376436 "2025-03-26T17:38:21Z")
Hello, I have seen in Observability, that elastic agent can collect metrics regarding metadata information about the host its monitoring. Like OS, Cloud Provider, Service Name I have not seen whether elastic agent c… --- ## [Elastic Agent Integrations Failing to Update](https://discuss.elastic.co/t/elastic-agent-integrations-failing-to-update/376422)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [March 26, 2025, 2:23pm UTC](https://discuss.elastic.co/t/elastic-agent-integrations-failing-to-update/376422 "2025-03-26T14:23:35Z")
Hello, I am on 8.17.3 ES/Kibana I attempted to reinstall and update some installed integrations and I keep getting errors: Seems like not related to a specific integration but is preventing from reinstalling or u… --- ## [Agent and integration are heatlhy, but no logs from vm](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376)
**Author:** [@Den\_Mat](https://discuss.elastic.co/u/Den_Mat)\ **Replies:** 5\ **Last updated:** [March 25, 2025, 3:00pm UTC](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376 "2025-03-25T15:00:51Z")
I installed an agent on a virtual machine to collect PostgreSQL logs through integration. The log paths are correct, and everything seems to be healthy. However, the logs are not being sent to ELK, and no data stream is… --- ## [DNS Integration stopped working](https://discuss.elastic.co/t/dns-integration-stopped-working/376214)
**Author:** [@ben-sec](https://discuss.elastic.co/u/ben-sec)\ **Replies:** 1\ **Last updated:** [March 24, 2025, 7:19am UTC](https://discuss.elastic.co/t/dns-integration-stopped-working/376214 "2025-03-24T07:19:23Z")
Hi! I'm running the Windows DNS integration and was successfully ingesting DNS logs from three different servers using Elastic Agent 8.14.3. After upgrading to 8.17.3, I no longer receive DNS logs from these servers. Ho… [Previous page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=7) [Next page](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91.md?page=9)