I’m having trouble trying to add Fleet and Agent to one of our existing elastic clusters (EDIT: es, kibana, agent all 9.1.5, in ECK managed cluster in an AWS EKS cluster). I was successfully able to do this on a newly built cluster in demo environment but in the next env up on an existing cluster, Fleet Server never seems to try to connect to the configured elastic cluster, instead trying to connect to localhost:9200. Note that this is using an istio service mesh, with tls/mtls disabled and again works in a lower environment with istio enabled and all other settings the same (though there are probably nuances between these environments).
I’ve tried enabling debug logging from fleet but documentation on this seems to be sparse and I’ve been unable to get any additional logs out. elastic-agent diagnostics does show the correct es endpoint is found in local-config.yml and fleet-server.yml, but computed-config.yaml and pre-config.yaml show localhost:9200
Connecting to the fleet server agent pod in shell, I’m able to curl successfully to the es endpoint.
fleet-server-output-request.txt shows the below:
2025/11/18 19:33:18.290055 TLS settings detected
2025/11/18 19:33:18.290058 Proxy disable=false url=
2025/11/18 19:33:18.290082 Request 0 to ``http://clustername-es-http.elasticsearch-enterprise.svc:9200`` starting
2025/11/18 19:33:18.290098 GetConn called for "clustername-es-http.elasticsearch-enterprise.svc:9200"
2025/11/18 19:33:18.290561 Connection started to tcp:172.20.149.47:9200
2025/11/18 19:33:18.290945 Connection to tcp:172.20.149.47:9200 done, err:
2025/11/18 19:33:18.290963 GotConn for "172.20.149.47:9200"
2025/11/18 19:33:18.290995 Wrote request headers
2025/11/18 19:33:18.290997 Wrote request err=
2025/11/18 19:33:18.292739 Response started
2025/11/18 19:33:18.292801 request 0 successful. status=200
Yet the fleet server pod crashloops:
agent.log
agent container initialisation - effective capabilities
agent container initialisation - ambient capabilities
agent container initialisation - chown paths
Policy selected for enrollment: clustername-fleet-server-policy
{"log.level":"info","@timestamp":"2025-11-20T14:26:09.910Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.(*enrollCmd).startAgent","file.name":"cmd/enroll_cmd.go","file.line":675},"message":"Spawning Elastic Agent daemon as a subprocess to complete bootstrap process.","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:10.498Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":203},"message":"Elastic Agent started","log":{"source":"elastic-agent"},"process.pid":33,"agent.version":"9.1.5","agent.unprivileged":true,"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:10.707Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.InvokeWatcher","file.name":"upgrade/rollback.go","file.line":149},"message":"agent is not upgradable, not starting watcher","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:10.709Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":292},"message":"APM instrumentation disabled","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:10.710Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":79},"message":"Gathered system information","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:10.784Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":85},"message":"Detected available inputs and outputs","log":{"source":"elastic-agent"},"inputs":["cloudbeat/vuln_mgmt_aws","aws-cloudwatch","azure-eventhub","kubernetes/metrics","audit/file_integrity","etw","http_endpoint","kafka","synthetics/icmp","o365audit","redis","postgresql/metrics","fleet-server","audit/auditd","audit/system","azure-blob-storage","autoops_es/metrics","system/metrics","containerd/metrics","http/metrics","cloudbeat/cis_aws","unifiedlogs","streaming","uwsgi/metrics","cloudfoundry/metrics","haproxy/metrics","kafka/metrics","meraki/metrics","cloudbeat/cis_eks","cloudbeat/cis_gcp","cel","entity-analytics","gcs","netflow","udp","docker/metrics","cloudbeat/cis_azure","cometd","container","gcp-pubsub","mqtt","tcp","winlog","elasticsearch/metrics","synthetics/browser","kibana/metrics","windows/metrics","aws/metrics","nats/metrics","rabbitmq/metrics","cloudbeat/asset_inventory_gcp","endpoint","log","synthetics/http","activemq/metrics","apache/metrics","iis/metrics","nginx/metrics","apm","cloudbeat/asset_inventory_azure","syncgateway/metrics","prometheus/metrics","sql/metrics","stan/metrics","traefik/metrics","cloudbeat/asset_inventory_aws","pf-elastic-collector","pf-elastic-symbolizer","httpjson","lumberjack","etcd/metrics","jolokia/metrics","openai/metrics","pf-host-agent","aws-s3","benchmark","beat/metrics","mssql/metrics","memcached/metrics","panw/metrics","vsphere/metrics","cloudbeat/cis_k8s","synthetics/tcp","linux/metrics","awsfargate/metrics","zookeeper/metrics","packet","cloudfoundry","unix","logstash/metrics","mysql/metrics","azure/metrics","gcp/metrics","statsd/metrics","filestream","mongodb/metrics","redis/metrics","oracle/metrics","salesforce","syslog","aerospike/metrics","cloudbeat","docker","journald","osquery"],"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:10.784Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/capabilities.LoadFile","file.name":"capabilities/capabilities.go","file.line":48},"message":"Capabilities file not found in /usr/share/elastic-agent/capabilities.yml","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:10.784Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":91},"message":"Determined allowed capabilities","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:10.784Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":106},"message":"Loading baseline config from /usr/share/elastic-agent/elastic-agent.yml","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.380Z","log.origin":{"function":"github.com/elastic/elastic-agent/pkg/component/runtime.NewManager","file.name":"runtime/manager.go","file.line":164},"message":"GRPC comms socket listening at localhost:6789","log":{"source":"elastic-agent"},"address":"localhost:6789","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.388Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":181},"message":"Parsed configuration and determined agent is in Fleet Server bootstrap mode","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.390Z","log.logger":"control","log.origin":{"function":"github.com/elastic/elastic-agent/pkg/control/v2/server.(*Server).Start","file.name":"server/server.go","file.line":91},"message":"GRPC control socket listening at unix:///usr/share/elastic-agent/state/data/Td8I7R-Zby36_zF_IOd9QVNlFblNEro3.sock","log":{"source":"elastic-agent"},"address":"unix:///usr/share/elastic-agent/state/data/Td8I7R-Zby36_zF_IOd9QVNlFblNEro3.sock","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.391Z","log.origin":{"function":"github.com/elastic/elastic-agent/pkg/component/runtime.(*Manager).Run","file.name":"runtime/manager.go","file.line":226},"message":"Starting grpc control protocol listener on port 6789 with max_message_size 104857600","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.392Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.(*Upgrader).Reload","file.name":"upgrade/upgrade.go","file.line":181},"message":"Source URI changed from "https://artifacts.elastic.co/downloads/\" to "https://artifacts.elastic.co/downloads/\"","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.392Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/monitoring/reload.(*ServerReloader).Start","file.name":"reload/reload.go","file.line":54},"message":"Starting monitoring server with cfg &config.MonitoringConfig{Enabled:true, MonitorLogs:true, MonitorMetrics:true, MetricsPeriod:"", FailureThreshold:(*uint)(nil), LogMetrics:true, HTTP:(*config.MonitoringHTTPConfig)(0xc001b6ddd0), Namespace:"default", Pprof:(*config.PprofConfig)(nil), MonitorTraces:false, APM:config.APMConfig{Environment:"", APIKey:"", SecretToken:"", Hosts:string(nil), GlobalLabels:map[string]string(nil), TLS:config.APMTLS{SkipVerify:false, ServerCertificate:"", ServerCA:""}, SamplingRate:(*float32)(nil)}, Diagnostics:config.Diagnostics{Uploader:config.Uploader{MaxRetries:10, InitDur:1000000000, MaxDur:600000000000}, Limit:config.Limit{Interval:60000000000, Burst:1}}, RuntimeManager:"process"}","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.392Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.setupMetrics.NewServer.func1","file.name":"monitoring/server.go","file.line":79},"message":"creating monitoring API with cfg api.Config{Enabled:true, Host:"http://localhost:6791", Port:6791, User:"", SecurityDescriptor:"", Timeout:5000000000}","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-11-20T14:26:11.392Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/monitoring/reload.(*ServerReloader).Start","file.name":"reload/reload.go","file.line":58},"message":"Failed creating a server: failed to create api server: listen tcp 127.0.0.1:6791: bind: address already in use","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.393Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).refreshComponentModel","file.name":"coordinator/coordinator.go","file.line":1621},"message":"Updating running component model","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:11.980Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll_cmd.go","file.line":808},"message":"Waiting for Elastic Agent to start Fleet Server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:13.500Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange","file.name":"coordinator/coordinator.go","file.line":834},"message":"Spawned new component fleet-server-default: Starting: spawned pid '47'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:13.500Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange","file.name":"coordinator/coordinator.go","file.line":842},"message":"Spawned new unit fleet-server-default-fleet-server: Starting: spawned pid '47'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"unit":{"id":"fleet-server-default-fleet-server","type":"input","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:13.500Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange","file.name":"coordinator/coordinator.go","file.line":842},"message":"Spawned new unit fleet-server-default: Starting: spawned pid '47'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"unit":{"id":"fleet-server-default","type":"output","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:13.685Z","message":"Boot fleet-server","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","pid":47,"args":["--agent-mode","-E","logging.level=debug","-E","logging.to_stderr=true","-E","path.data=/usr/share/elastic-agent/state/data/run/fleet-server-default"],"ecs.version":"1.6.0","service.type":"fleet-server","version":"9.1.5","commit":"17e717f5","fips-distribution":false,"ppid":33,"exe":"/usr/share/elastic-agent/data/elastic-agent-7bee01/components/fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:13.685Z","message":"starting communication connection back to Elastic Agent","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:13.781Z","log.logger":"component.runtime.fleet-server-default","log.origin":{"function":"github.com/elastic/elastic-agent/pkg/component/runtime.(*Manager).CheckinV2","file.name":"runtime/manager.go","file.line":693},"message":"control checkin v2 protocol has chunking enabled","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:13.782Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange","file.name":"coordinator/coordinator.go","file.line":855},"message":"Component state changed fleet-server-default (STARTING->HEALTHY): Healthy: communicating with pid '47'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"HEALTHY","old_state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:15.984Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll_cmd.go","file.line":841},"message":"Fleet Server - waiting for output unit","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-11-20T14:26:24.540Z","message":"failed to fetch elasticsearch version","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","error.message":"dial tcp [::1]:9200: connect: connection refused","@timestamp":"2025-11-20T14:26:24.54Z","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-11-20T14:26:24.540Z","message":"Failed Elasticsearch output configuration test, using bootstrap values.","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"error.message":"dial tcp [::1]:9200: connect: connection refused","output":{"Elasticsearch":{"Headers":null,"Hosts":["localhost:9200"],"MaxConnPerHost":128,"MaxContentLength":104857600,"MaxRetries":3,"Path":"","Protocol":"http","ProxyDisable":false,"ProxyHeaders":{},"ProxyURL":"","ServiceToken":"[redacted]","ServiceTokenPath":"","TLS":{"CASha256":null,"CATrustedFingerprint":"","CAs":["/mnt/elastic-internal/elasticsearch-association/elasticsearch-enterprise/use1-prod-siem/certs/ca.crt"],"Certificate":{"Certificate":"","Key":"","Passphrase":"","PassphrasePath":""},"CipherSuites":null,"CurveTypes":null,"Enabled":null,"Renegotiation":"never","VerificationMode":"full","Versions":null},"Timeout":90000000000},"Extra":null},"@timestamp":"2025-11-20T14:26:24.54Z","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.541Z","message":"Found settings with recommended ram.","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","memory_mb":31378,"recommended_mb":16192,"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.541Z","message":"Setting cache config options","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","cfg":{"APIKeyJitter":300000000000,"APIKeyTTL":900000000000,"ActionTTL":300000000000,"ArtifactTTL":86400000000000,"EnrollKeyTTL":60000000000,"MaxCost":268435456,"NumCounters":1600000},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.543Z","message":"Starting","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.543Z","message":"Found settings with recommended ram.","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","memory_mb":31378,"recommended_mb":16192,"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.543Z","message":"initial server configuration","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.543Z","message":"starting server on configuration change","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.544Z","message":"Run bulker with options","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","opts":{"apikeyMaxParallel":120,"apikeyMaxReqSize":104857600,"blockQueueSz":32,"flushInterval":250,"flushThresholdCnt":2048,"flushThresholdSz":1048576,"maxPending":8},"ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.546Z","message":"Elasticsearch compatibility check successful","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","fleet_version":"9.1.5","elasticsearch_version":"9.1.5","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.553Z","message":"migration AgentMetadata done","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","fleet.migration.es.took":4,"fleet.migration.retries.bulk":0,"fleet.migration.retries.search":0,"service.name":"fleet-server","fleet.migration.es.timed_out":false,"fleet.migration.version_conflicts":0,"fleet.migration.total.count":0,"service.type":"fleet-server","fleet.migration.updated":0,"fleet.migration.deleted":0,"fleet.migration.batches":0,"fleet.migration.noops":0,"fleet.migration.total.duration":7.068352,"fleet.migration.name":"AgentMetadata","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.560Z","message":"migration AgentOutputs done","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"fleet.migration.deleted":0,"fleet.migration.batches":0,"fleet.migration.version_conflicts":0,"fleet.migration.retries.bulk":0,"ecs.version":"1.6.0","fleet.migration.noops":0,"fleet.migration.retries.search":0,"@timestamp":"2025-11-20T14:26:24.56Z","service.name":"fleet-server","fleet.migration.name":"AgentOutputs","fleet.migration.es.took":4,"fleet.migration.total.count":0,"service.type":"fleet-server","fleet.migration.es.timed_out":false,"fleet.migration.total.duration":6.442079,"fleet.migration.updated":0,"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.560Z","message":"starting index monitor","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"index":".fleet-policies","ctx":"index monitor","@timestamp":"2025-11-20T14:26:24.56Z","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.560Z","message":"starting index monitor","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","index":".fleet-actions","ctx":"index monitor","@timestamp":"2025-11-20T14:26:24.56Z","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.560Z","message":"run policy monitor","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","ctx":"policy agent monitor","burst":1,"event_rate":500,"@timestamp":"2025-11-20T14:26:24.56Z","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.561Z","message":"server hard connection limiter disabled","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-11-20T14:26:24.561Z","message":"Exposed over insecure HTTP; enablement of TLS is strongly recommended","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.561Z","message":"Listening on localhost:8221","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.561Z","message":"server hard connection limiter disabled","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-11-20T14:26:24.561Z","message":"Exposed over insecure HTTP; enablement of TLS is strongly recommended","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.561Z","message":"Listening on 0.0.0.0:8220","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:24.826Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:30.088Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:35.352Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:39.990Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll_cmd.go","file.line":841},"message":"Fleet Server - Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:40.617Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:45.884Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:51.150Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"@timestamp":"2025-11-20T14:26:51.15Z","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:26:56.416Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:01.682Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:06.949Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:12.212Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:17.487Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:22.753Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:28.020Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","@timestamp":"2025-11-20T14:27:28.02Z","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:33.285Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2025-11-20T14:27:34.737Z","message":"failed to fetch elasticsearch version","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","error.message":"dial tcp [::1]:9200: connect: connection refused","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:38.549Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:43.813Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:49.074Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:54.340Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","@timestamp":"2025-11-20T14:27:54.34Z","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:27:59.614Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:28:04.881Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:28:09.911Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll_cmd.go","file.line":791},"message":"Waiting for Elastic Agent to start","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:28:09.911Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":388},"message":"signal "terminated" received","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:28:09.911Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":400},"message":"Shutting down Elastic Agent and sending last events...","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:28:09.912Z","message":"On signal","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"sig":"terminated","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-11-20T14:28:10.112Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":406},"message":"Shutting down completed.","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
Error: fleet-server failed: timed out waiting for Fleet Server to start after 2m0s
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/9.1/fleet-troubleshooting.html
Error: enrollment failed: exit status 1
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/9.1/fleet-troubleshooting.html