# Adding Fleet/Agent to existing ECK managed cluster

**URL:** <https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556>\
**Category:** Elastic Agent\
**Created:** [November 20, 2025, 2:40pm UTC](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556 "2025-11-20T14:40:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![smashley](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@smashley](https://discuss.elastic.co/u/smashley)\
**Post date:** [November 20, 2025, 2:41pm UTC](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556/1 "2025-11-20T14:41:00Z")

</div>

I’m having trouble trying to add Fleet and Agent to one of our existing elastic clusters (EDIT: es, kibana, agent all 9.1.5, in ECK managed cluster in an AWS EKS cluster). I was successfully able to do this on a newly built cluster in demo environment but in the next env up on an existing cluster, Fleet Server never seems to try to connect to the configured elastic cluster, instead trying to connect to localhost:9200. Note that this is using an istio service mesh, with tls/mtls disabled and again works in a lower environment with istio enabled and all other settings the same (though there are probably nuances between these environments).

I’ve tried enabling debug logging from fleet but documentation on this seems to be sparse and I’ve been unable to get any additional logs out. elastic-agent diagnostics does show the correct es endpoint is found in local-config.yml and fleet-server.yml, but computed-config.yaml and pre-config.yaml show localhost:9200

Connecting to the fleet server agent pod in shell, I’m able to curl successfully to the es endpoint.

fleet-server-output-request.txt shows the below:  
`2025/11/18 19:33:18.290055 TLS settings detected`  
`2025/11/18 19:33:18.290058 Proxy disable=false url=`  
`2025/11/18 19:33:18.290082 Request 0 to ``http://clustername-es-http.elasticsearch-enterprise.svc:9200`` starting`  
`2025/11/18 19:33:18.290098 GetConn called for "clustername-es-http.elasticsearch-enterprise.svc:9200"`  
`2025/11/18 19:33:18.290561 Connection started to tcp:172.20.149.47:9200`  
`2025/11/18 19:33:18.290945 Connection to tcp:172.20.149.47:9200 done, err: `  
`2025/11/18 19:33:18.290963 GotConn for "172.20.149.47:9200"`  
`2025/11/18 19:33:18.290995 Wrote request headers`  
`2025/11/18 19:33:18.290997 Wrote request err=`  
`2025/11/18 19:33:18.292739 Response started`  
`2025/11/18 19:33:18.292801 request 0 successful. status=200`

Yet the fleet server pod crashloops:

> **agent.log**
>
> agent container initialisation - effective capabilities  
> agent container initialisation - ambient capabilities  
> agent container initialisation - chown paths  
> Policy selected for enrollment: clustername-fleet-server-policy  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:09.910Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.(\*enrollCmd).startAgent","file.name":"cmd/enroll\_cmd.go","file.line":675},"message":"Spawning](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.(*enrollCmd).startAgent%22,%22file.name%22:%22cmd/enroll_cmd.go%22,%22file.line%22:675%7D,%22message%22:%22Spawning) Elastic Agent daemon as a subprocess to complete bootstrap process.","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:10.498Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":203},"message":"Elastic](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent%22,%22file.name%22:%22cmd/run.go%22,%22file.line%22:203%7D,%22message%22:%22Elastic) Agent started","log":{"source":"elastic-agent"},"process.pid":33,"agent.version":"9.1.5","agent.unprivileged":true,"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:10.707Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.InvokeWatcher","file.name":"upgrade/rollback.go","file.line":149},"message":"agent](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.InvokeWatcher%22,%22file.name%22:%22upgrade/rollback.go%22,%22file.line%22:149%7D,%22message%22:%22agent) is not upgradable, not starting watcher","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:10.709Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":292},"message":"APM](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent%22,%22file.name%22:%22cmd/run.go%22,%22file.line%22:292%7D,%22message%22:%22APM) instrumentation disabled","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:10.710Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":79},"message":"Gathered](http://github.com/elastic/elastic-agent/internal/pkg/agent/application.New%22,%22file.name%22:%22application/application.go%22,%22file.line%22:79%7D,%22message%22:%22Gathered) system information","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:10.784Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":85},"message":"Detected](http://github.com/elastic/elastic-agent/internal/pkg/agent/application.New%22,%22file.name%22:%22application/application.go%22,%22file.line%22:85%7D,%22message%22:%22Detected) available inputs and outputs","log":{"source":"elastic-agent"},"inputs":["cloudbeat/vuln\_mgmt\_aws","aws-cloudwatch","azure-eventhub","kubernetes/metrics","audit/file\_integrity","etw","http\_endpoint","kafka","synthetics/icmp","o365audit","redis","postgresql/metrics","fleet-server","audit/auditd","audit/system","azure-blob-storage","autoops\_es/metrics","system/metrics","containerd/metrics","http/metrics","cloudbeat/cis\_aws","unifiedlogs","streaming","uwsgi/metrics","cloudfoundry/metrics","haproxy/metrics","kafka/metrics","meraki/metrics","cloudbeat/cis\_eks","cloudbeat/cis\_gcp","cel","entity-analytics","gcs","netflow","udp","docker/metrics","cloudbeat/cis\_azure","cometd","container","gcp-pubsub","mqtt","tcp","winlog","elasticsearch/metrics","synthetics/browser","kibana/metrics","windows/metrics","aws/metrics","nats/metrics","rabbitmq/metrics","cloudbeat/asset\_inventory\_gcp","endpoint","log","synthetics/http","activemq/metrics","apache/metrics","iis/metrics","nginx/metrics","apm","cloudbeat/asset\_inventory\_azure","syncgateway/metrics","prometheus/metrics","sql/metrics","stan/metrics","traefik/metrics","cloudbeat/asset\_inventory\_aws","pf-elastic-collector","pf-elastic-symbolizer","httpjson","lumberjack","etcd/metrics","jolokia/metrics","openai/metrics","pf-host-agent","aws-s3","benchmark","beat/metrics","mssql/metrics","memcached/metrics","panw/metrics","vsphere/metrics","cloudbeat/cis\_k8s","synthetics/tcp","linux/metrics","awsfargate/metrics","zookeeper/metrics","packet","cloudfoundry","unix","logstash/metrics","mysql/metrics","azure/metrics","gcp/metrics","statsd/metrics","filestream","mongodb/metrics","redis/metrics","oracle/metrics","salesforce","syslog","aerospike/metrics","cloudbeat","docker","journald","osquery"],"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:10.784Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/capabilities.LoadFile","file.name":"capabilities/capabilities.go","file.line":48},"message":"Capabilities](http://github.com/elastic/elastic-agent/internal/pkg/capabilities.LoadFile%22,%22file.name%22:%22capabilities/capabilities.go%22,%22file.line%22:48%7D,%22message%22:%22Capabilities) file not found in /usr/share/elastic-agent/capabilities.yml","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:10.784Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":91},"message":"Determined](http://github.com/elastic/elastic-agent/internal/pkg/agent/application.New%22,%22file.name%22:%22application/application.go%22,%22file.line%22:91%7D,%22message%22:%22Determined) allowed capabilities","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:10.784Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":106},"message":"Loading](http://github.com/elastic/elastic-agent/internal/pkg/agent/application.New%22,%22file.name%22:%22application/application.go%22,%22file.line%22:106%7D,%22message%22:%22Loading) baseline config from /usr/share/elastic-agent/elastic-agent.yml","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.380Z","log.origin":{"function":"[github.com/elastic/elastic-agent/pkg/component/runtime.NewManager","file.name":"runtime/manager.go","file.line":164},"message":"GRPC](http://github.com/elastic/elastic-agent/pkg/component/runtime.NewManager%22,%22file.name%22:%22runtime/manager.go%22,%22file.line%22:164%7D,%22message%22:%22GRPC) comms socket listening at localhost:6789","log":{"source":"elastic-agent"},"address":"localhost:6789","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.388Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":181},"message":"Parsed](http://github.com/elastic/elastic-agent/internal/pkg/agent/application.New%22,%22file.name%22:%22application/application.go%22,%22file.line%22:181%7D,%22message%22:%22Parsed) configuration and determined agent is in Fleet Server bootstrap mode","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.390Z","log.logger":"control","log.origin":{"function":"[github.com/elastic/elastic-agent/pkg/control/v2/server.(\*Server).Start","file.name":"server/server.go","file.line":91},"message":"GRPC](http://github.com/elastic/elastic-agent/pkg/control/v2/server.(*Server).Start%22,%22file.name%22:%22server/server.go%22,%22file.line%22:91%7D,%22message%22:%22GRPC) control socket listening at unix:///usr/share/elastic-agent/state/data/Td8I7R-Zby36\_zF\_IOd9QVNlFblNEro3.sock","log":{"source":"elastic-agent"},"address":"unix:///usr/share/elastic-agent/state/data/Td8I7R-Zby36\_zF\_IOd9QVNlFblNEro3.sock","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.391Z","log.origin":{"function":"[github.com/elastic/elastic-agent/pkg/component/runtime.(\*Manager).Run","file.name":"runtime/manager.go","file.line":226},"message":"Starting](http://github.com/elastic/elastic-agent/pkg/component/runtime.(*Manager).Run%22,%22file.name%22:%22runtime/manager.go%22,%22file.line%22:226%7D,%22message%22:%22Starting) grpc control protocol listener on port 6789 with max\_message\_size 104857600","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.392Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.(\*Upgrader).Reload","file.name":"upgrade/upgrade.go","file.line":181},"message":"Source](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.(*Upgrader).Reload%22,%22file.name%22:%22upgrade/upgrade.go%22,%22file.line%22:181%7D,%22message%22:%22Source) URI changed from "[https://artifacts.elastic.co/downloads/\](https://artifacts.elastic.co/downloads/%5C)" to "[https://artifacts.elastic.co/downloads/\](https://artifacts.elastic.co/downloads/%5C)"","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.392Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/monitoring/reload.(\*ServerReloader).Start","file.name":"reload/reload.go","file.line":54},"message":"Starting](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/monitoring/reload.(*ServerReloader).Start%22,%22file.name%22:%22reload/reload.go%22,%22file.line%22:54%7D,%22message%22:%22Starting) monitoring server with cfg &config.MonitoringConfig{Enabled:true, MonitorLogs:true, MonitorMetrics:true, MetricsPeriod:"", FailureThreshold:(\*uint)(nil), LogMetrics:true, HTTP:(\*config.MonitoringHTTPConfig)(0xc001b6ddd0), Namespace:"default", Pprof:(\*config.PprofConfig)(nil), MonitorTraces:false, APM:config.APMConfig{Environment:"", APIKey:"", SecretToken:"", Hosts:string(nil), GlobalLabels:map[string]string(nil), TLS:config.APMTLS{SkipVerify:false, ServerCertificate:"", ServerCA:""}, SamplingRate:(\*float32)(nil)}, Diagnostics:config.Diagnostics{Uploader:config.Uploader{MaxRetries:10, InitDur:1000000000, MaxDur:600000000000}, Limit:config.Limit{Interval:60000000000, Burst:1}}, RuntimeManager:"process"}","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.392Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.setupMetrics.NewServer.func1","file.name":"monitoring/server.go","file.line":79},"message":"creating](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.setupMetrics.NewServer.func1%22,%22file.name%22:%22monitoring/server.go%22,%22file.line%22:79%7D,%22message%22:%22creating) monitoring API with cfg api.Config{Enabled:true, Host:"[http://localhost:6791](http://localhost:6791)", Port:6791, User:"", SecurityDescriptor:"", Timeout:5000000000}","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"error","@timestamp":"2025-11-20T14:26:11.392Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/monitoring/reload.(\*ServerReloader).Start","file.name":"reload/reload.go","file.line":58},"message":"Failed](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/monitoring/reload.(*ServerReloader).Start%22,%22file.name%22:%22reload/reload.go%22,%22file.line%22:58%7D,%22message%22:%22Failed) creating a server: failed to create api server: listen tcp 127.0.0.1:6791: bind: address already in use","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.393Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(\*Coordinator).refreshComponentModel","file.name":"coordinator/coordinator.go","file.line":1621},"message":"Updating](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).refreshComponentModel%22,%22file.name%22:%22coordinator/coordinator.go%22,%22file.line%22:1621%7D,%22message%22:%22Updating) running component model","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:11.980Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll\_cmd.go","file.line":808},"message":"Waiting](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1%22,%22file.name%22:%22cmd/enroll_cmd.go%22,%22file.line%22:808%7D,%22message%22:%22Waiting) for Elastic Agent to start Fleet Server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:13.500Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange","file.name":"coordinator/coordinator.go","file.line":834},"message":"Spawned](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange%22,%22file.name%22:%22coordinator/coordinator.go%22,%22file.line%22:834%7D,%22message%22:%22Spawned) new component fleet-server-default: Starting: spawned pid '47'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:13.500Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange","file.name":"coordinator/coordinator.go","file.line":842},"message":"Spawned](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange%22,%22file.name%22:%22coordinator/coordinator.go%22,%22file.line%22:842%7D,%22message%22:%22Spawned) new unit fleet-server-default-fleet-server: Starting: spawned pid '47'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"unit":{"id":"fleet-server-default-fleet-server","type":"input","state":"STARTING"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:13.500Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange","file.name":"coordinator/coordinator.go","file.line":842},"message":"Spawned](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange%22,%22file.name%22:%22coordinator/coordinator.go%22,%22file.line%22:842%7D,%22message%22:%22Spawned) new unit fleet-server-default: Starting: spawned pid '47'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"unit":{"id":"fleet-server-default","type":"output","state":"STARTING"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:13.685Z","message":"Boot fleet-server","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","pid":47,"args":["--agent-mode","-E","logging.level=debug","-E","logging.to\_stderr=true","-E","path.data=/usr/share/elastic-agent/state/data/run/fleet-server-default"],"ecs.version":"1.6.0","service.type":"fleet-server","version":"9.1.5","commit":"17e717f5","fips-distribution":false,"ppid":33,"exe":"/usr/share/elastic-agent/data/elastic-agent-7bee01/components/fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:13.685Z","message":"starting communication connection back to Elastic Agent","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:13.781Z","log.logger":"component.runtime.fleet-server-default","log.origin":{"function":"[github.com/elastic/elastic-agent/pkg/component/runtime.(\*Manager).CheckinV2","file.name":"runtime/manager.go","file.line":693},"message":"control](http://github.com/elastic/elastic-agent/pkg/component/runtime.(*Manager).CheckinV2%22,%22file.name%22:%22runtime/manager.go%22,%22file.line%22:693%7D,%22message%22:%22control) checkin v2 protocol has chunking enabled","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:13.782Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange","file.name":"coordinator/coordinator.go","file.line":855},"message":"Component](http://github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.logComponentStateChange%22,%22file.name%22:%22coordinator/coordinator.go%22,%22file.line%22:855%7D,%22message%22:%22Component) state changed fleet-server-default (STARTING-\>HEALTHY): Healthy: communicating with pid '47'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"HEALTHY","old\_state":"STARTING"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:15.984Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll\_cmd.go","file.line":841},"message":"Fleet](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1%22,%22file.name%22:%22cmd/enroll_cmd.go%22,%22file.line%22:841%7D,%22message%22:%22Fleet) Server - waiting for output unit","ecs.version":"1.6.0"}  
> {"log.level":"error","@timestamp":"2025-11-20T14:26:24.540Z","message":"failed to fetch elasticsearch version","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","error.message":"dial tcp [::1]:9200: connect: connection refused","@timestamp":"2025-11-20T14:26:24.54Z","ecs.version":"1.6.0","ecs.version":"1.6.0"}  
> {"log.level":"warn","@timestamp":"2025-11-20T14:26:24.540Z","message":"Failed Elasticsearch output configuration test, using bootstrap values.","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"error.message":"dial tcp [::1]:9200: connect: connection refused","output":{"Elasticsearch":{"Headers":null,"Hosts":["localhost:9200"],"MaxConnPerHost":128,"MaxContentLength":104857600,"MaxRetries":3,"Path":"","Protocol":"http","ProxyDisable":false,"ProxyHeaders":{},"ProxyURL":"","ServiceToken":"[redacted]","ServiceTokenPath":"","TLS":{"CASha256":null,"CATrustedFingerprint":"","CAs":["/mnt/elastic-internal/elasticsearch-association/elasticsearch-enterprise/use1-prod-siem/certs/ca.crt"],"Certificate":{"Certificate":"","Key":"","Passphrase":"","PassphrasePath":""},"CipherSuites":null,"CurveTypes":null,"Enabled":null,"Renegotiation":"never","VerificationMode":"full","Versions":null},"Timeout":90000000000},"Extra":null},"@timestamp":"2025-11-20T14:26:24.54Z","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.541Z","message":"Found settings with recommended ram.","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","memory\_mb":31378,"recommended\_mb":16192,"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.541Z","message":"Setting cache config options","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","cfg":{"APIKeyJitter":300000000000,"APIKeyTTL":900000000000,"ActionTTL":300000000000,"ArtifactTTL":86400000000000,"EnrollKeyTTL":60000000000,"MaxCost":268435456,"NumCounters":1600000},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.543Z","message":"Starting","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.543Z","message":"Found settings with recommended ram.","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","memory\_mb":31378,"recommended\_mb":16192,"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.543Z","message":"initial server configuration","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.543Z","message":"starting server on configuration change","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.544Z","message":"Run bulker with options","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","opts":{"apikeyMaxParallel":120,"apikeyMaxReqSize":104857600,"blockQueueSz":32,"flushInterval":250,"flushThresholdCnt":2048,"flushThresholdSz":1048576,"maxPending":8},"ecs.version":"1.6.0","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.546Z","message":"Elasticsearch compatibility check successful","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","fleet\_version":"9.1.5","elasticsearch\_version":"9.1.5","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.553Z","message":"migration AgentMetadata done","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","fleet.migration.es.took":4,"fleet.migration.retries.bulk":0,"fleet.migration.retries.search":0,"service.name":"fleet-server","fleet.migration.es.timed\_out":false,"fleet.migration.version\_conflicts":0,"fleet.migration.total.count":0,"service.type":"fleet-server","fleet.migration.updated":0,"fleet.migration.deleted":0,"fleet.migration.batches":0,"fleet.migration.noops":0,"fleet.migration.total.duration":7.068352,"fleet.migration.name":"AgentMetadata","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.560Z","message":"migration AgentOutputs done","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"fleet.migration.deleted":0,"fleet.migration.batches":0,"fleet.migration.version\_conflicts":0,"fleet.migration.retries.bulk":0,"ecs.version":"1.6.0","fleet.migration.noops":0,"fleet.migration.retries.search":0,"@timestamp":"2025-11-20T14:26:24.56Z","service.name":"fleet-server","fleet.migration.name":"AgentOutputs","fleet.migration.es.took":4,"fleet.migration.total.count":0,"service.type":"fleet-server","fleet.migration.es.timed\_out":false,"fleet.migration.total.duration":6.442079,"fleet.migration.updated":0,"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.560Z","message":"starting index monitor","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"index":".fleet-policies","ctx":"index monitor","@timestamp":"2025-11-20T14:26:24.56Z","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.560Z","message":"starting index monitor","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","index":".fleet-actions","ctx":"index monitor","@timestamp":"2025-11-20T14:26:24.56Z","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.560Z","message":"run policy monitor","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","ctx":"policy agent monitor","burst":1,"event\_rate":500,"@timestamp":"2025-11-20T14:26:24.56Z","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.561Z","message":"server hard connection limiter disabled","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0","ecs.version":"1.6.0"}  
> {"log.level":"warn","@timestamp":"2025-11-20T14:26:24.561Z","message":"Exposed over insecure HTTP; enablement of TLS is strongly recommended","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.561Z","message":"Listening on localhost:8221","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.561Z","message":"server hard connection limiter disabled","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"warn","@timestamp":"2025-11-20T14:26:24.561Z","message":"Exposed over insecure HTTP; enablement of TLS is strongly recommended","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.561Z","message":"Listening on 0.0.0.0:8220","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:24.826Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:30.088Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:35.352Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:39.990Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll\_cmd.go","file.line":841},"message":"Fleet](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1%22,%22file.name%22:%22cmd/enroll_cmd.go%22,%22file.line%22:841%7D,%22message%22:%22Fleet) Server - Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:40.617Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:45.884Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:51.150Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"@timestamp":"2025-11-20T14:26:51.15Z","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:26:56.416Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:01.682Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:06.949Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:12.212Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:17.487Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:22.753Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:28.020Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","@timestamp":"2025-11-20T14:27:28.02Z","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:33.285Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"error","@timestamp":"2025-11-20T14:27:34.737Z","message":"failed to fetch elasticsearch version","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","error.message":"dial tcp [::1]:9200: connect: connection refused","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:38.549Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:43.813Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:49.074Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"state":"STARTING","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:54.340Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","@timestamp":"2025-11-20T14:27:54.34Z","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:27:59.614Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:28:04.881Z","message":"Waiting on fleet-server input to be added to policy: use1-prod-siem-fleet-server-policy","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:28:09.911Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll\_cmd.go","file.line":791},"message":"Waiting](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1%22,%22file.name%22:%22cmd/enroll_cmd.go%22,%22file.line%22:791%7D,%22message%22:%22Waiting) for Elastic Agent to start","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:28:09.911Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":388},"message":"signal](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent%22,%22file.name%22:%22cmd/run.go%22,%22file.line%22:388%7D,%22message%22:%22signal) "terminated" received","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:28:09.911Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":400},"message":"Shutting](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent%22,%22file.name%22:%22cmd/run.go%22,%22file.line%22:400%7D,%22message%22:%22Shutting) down Elastic Agent and sending last events...","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:28:09.912Z","message":"On signal","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"sig":"terminated","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}  
> {"log.level":"info","@timestamp":"2025-11-20T14:28:10.112Z","log.origin":{"function":"[github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":406},"message":"Shutting](http://github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent%22,%22file.name%22:%22cmd/run.go%22,%22file.line%22:406%7D,%22message%22:%22Shutting) down completed.","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}  
> Error: fleet-server failed: timed out waiting for Fleet Server to start after 2m0s  
> For help, please see our troubleshooting guide at [https://www.elastic.co/guide/en/fleet/9.1/fleet-troubleshooting.html](https://www.elastic.co/guide/en/fleet/9.1/fleet-troubleshooting.html)  
> Error: enrollment failed: exit status 1  
> For help, please see our troubleshooting guide at [https://www.elastic.co/guide/en/fleet/9.1/fleet-troubleshooting.html](https://www.elastic.co/guide/en/fleet/9.1/fleet-troubleshooting.html)

---

<div class="post-metadata">

**Author:** ![smashley](https://avatars.discourse-cdn.com/v4/letter/s/6a8cbe/32.png) [@smashley](https://discuss.elastic.co/u/smashley)\
**Post date:** [November 20, 2025, 5:45pm UTC](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556/2 "2025-11-20T17:45:15Z")

</div>

As it turns out I was too focused on the errors around localhost:9200 and completely missed the fact that my server policy didn’t have the fleet server integration in it for some reason. Once this was added Fleet began working.
