# Agent and integration are heatlhy, but no logs from vm

**URL:** <https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376>\
**Category:** Elastic Agent\
**Tags:** filebeat\
**Created:** [March 25, 2025, 11:18am UTC](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376 "2025-03-25T11:18:19Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Den\_Mat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/den_mat/32/123188_2.png) [@Den\_Mat](https://discuss.elastic.co/u/Den_Mat)\
**Post date:** [March 25, 2025, 11:18am UTC](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376/1 "2025-03-25T11:18:19Z")

</div>

I installed an agent on a virtual machine to collect PostgreSQL logs through integration. The log paths are correct, and everything seems to be healthy.  
However, the logs are not being sent to ELK, and no data stream is being created.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/f/7f2476c239d38f319cc4bc869e9c39e5bb472d6d.png)  
Fleet server: [docker.elastic.co/beats/elastic-agent:8.17.0](http://docker.elastic.co/beats/elastic-agent:8.17.0)  
ELK: [docker.elastic.co/elasticsearch/elasticsearch:8.17.0](http://docker.elastic.co/elasticsearch/elasticsearch:8.17.0)  
Agent version: 8.17.3  
Platform: ubuntu  
The agent logs are empty.

diagnostic file isn't generating

---

<div class="post-metadata">

**Author:** ![Den\_Mat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/den_mat/32/123188_2.png) [@Den\_Mat](https://discuss.elastic.co/u/Den_Mat)\
**Post date:** [March 25, 2025, 11:20am UTC](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376/2 "2025-03-25T11:20:07Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/2/b2506e3ca8d1d783f9b45ef86e9dd2cc7d691c53.png)

---

<div class="post-metadata">

**Author:** ![Den\_Mat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/den_mat/32/123188_2.png) [@Den\_Mat](https://discuss.elastic.co/u/Den_Mat)\
**Post date:** [March 25, 2025, 11:20am UTC](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376/3 "2025-03-25T11:20:51Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/0/c03e7a4e41d721ad1708118581d9a6dc259b1d15.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 25, 2025, 1:56pm UTC](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376/4 "2025-03-25T13:56:30Z")

</div>

What is the output of this policy?

Check if the VM can connect to the output, from what you described your agent cannot reach the configured output.

The healthy of the agent is only relative to the Fleet Server and if the integrations are running without issue, it does not take into consideration the communicaton from the agent to the configured output.

For example, if your output is Elasticsearch and your agent cannot reach Elasticsearch, but can reach the Fleet Server, it will appear as healthy, but you will have no data (also will not be able to get a diagnostic remotely).

You will need to check the log file directly in the server.

---

<div class="post-metadata">

**Author:** ![Den\_Mat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/den_mat/32/123188_2.png) [@Den\_Mat](https://discuss.elastic.co/u/Den_Mat)\
**Post date:** [March 25, 2025, 2:53pm UTC](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376/5 "2025-03-25T14:53:19Z")

</div>

Yes, the output shows the internal elasticsearch URL, how to change it when or after installing an agent?

```auto
outputs:
  default:
    api_key: <REDACTED>
    hosts:
    - https://elasticsearch-es-http:9200
    preset: balanced
    type: elasticsearch

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 25, 2025, 3:00pm UTC](https://discuss.elastic.co/t/agent-and-integration-are-heatlhy-but-no-logs-from-vm/376376/6 "2025-03-25T15:00:51Z")

</div>

Is this output accessible to the agent?

If not you need to edit it Fleet Settings and configure it to the endpoint that it is accessible to the agent.

You can edit it in the Settings tab in the Fleet page.