# Breaking changes between elastic agent 8.16.1 and 8.16.3 **URL:** \ **Category:** Elastic Agent\ **Tags:** elastic-stack-security, filebeat\ **Created:** [February 7, 2025, 10:04am UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219 "2025-02-07T10:04:18Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![mtr\_sw](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@mtr\_sw](https://discuss.elastic.co/u/mtr_sw)\ **Post date:** [February 7, 2025, 10:04am UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/1 "2025-02-07T10:04:18Z")
We were successfully running the elastic agent using the image 8.16.1 in a Kubernetes replica set with the following environment variables set: ```auto FLEET_ENROLL = "1" FLEET_URL=" via https" FLEET_ENROLLMENT_TOKEN="" ``` The security department asked us to update to the latest image version(8.16.3) because the version 8.16.1 was known to have critical vulnerabilies. I did so, and after just changing the minor image version I started getting the errors like: Attempting to reconnect to backoff(elasticsearch( http:// elasticsearch: 9200)) with 4 reconnect attempt(s)" I saw the documentation from elastic about the elastic agent environment variables: [Elastic Agent environment variables | Fleet and Elastic Agent Guide [8.17] and tried to update my variables to: ```auto FLEET_SERVER_ENABLE = "1" FLEET_SERVER_ELASTICSEARCH_HOST= " via https" FLEET_SERVER_SERVICE_TOKEN="" ``` But the issue still persists. It looks like a breaking change between these minor versions, please help! ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [February 7, 2025, 5:46pm UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/2 "2025-02-07T17:46:00Z")
Hi @mtr_sw, Welcome! Can you confirm you are looking at the [Elastic 8.16 documentation](https://www.elastic.co/guide/en/fleet/8.16/agent-environment-variables.html) rather than the 8.17 documentation you state in your post? I don't see any breaking changes between minors 8.16.1 and 8.16.3 listed in the documentation, so I wouldn't expect you to need to change your variables. Let us know! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 7, 2025, 6:01pm UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/3 "2025-02-07T18:01:34Z")
> [@mtr\_sw](#): > > backoff(elasticsearch( http:// elasticsearch: 9200)) > `FLEET_SERVER_ELASTICSEARCH_HOST` (string) The Elasticsearch host for Fleet Server to communicate with. Overrides `ELASTICSEARCH_HOST` when set. > > **Default:** `http://elasticsearch:9200` What it looks like to me is that variable is not getting picked up. This has been the setting in 8.16.1 it did not change between 8.16.1 and 8.16.3 so I am not sure how it was working before Can you show more of the logs... can you show the actually lines in context... Another source of that error can be if you have turned on monitoring in the policy and have not provide an output for the agent monitoring data.. .then it will default to `http://elasticsearch:9200` ---
**Author:** ![mtr\_sw](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@mtr\_sw](https://discuss.elastic.co/u/mtr_sw)\ **Post date:** [February 18, 2025, 8:24am UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/4 "2025-02-18T08:24:53Z")
Hi Carly, thanks for pointing this out you are right the variables in the second code snippet were from the wrong elastic version. ---
**Author:** ![mtr\_sw](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@mtr\_sw](https://discuss.elastic.co/u/mtr_sw)\ **Post date:** [February 18, 2025, 9:05am UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/5 "2025-02-18T09:05:06Z")
> [@stephenb](#): > > elasticsearch Hi Stephen, thanks for the hint I tried to set this environment variable bus still the log with `http://elasticsearch:9200` not reachable is there. I have updated to the latest 8.17 image In my desperate tries I have defined all possible variables: ```auto ELASTICSEARCH_HOST=https://.fleet.privatelink.westeurope.azure.elastic-cloud.com:443 FLEET_SERVER_HOST=https://.fleet.privatelink.westeurope.azure.elastic-cloud.com:443 FLEET_SERVER_ELASTICSEARCH_HOST=https://.fleet.privatelink.westeurope.azure.elastic-cloud.com:443 ``` But I am still receiving the error about the elasticsearch:9200: `Failed to connect to backoff(elasticsearch(http://elasticsearch:9200)): Get \"http://elasticsearch:9200\": lookup elasticsearch on 10.197.0.10:53: no such host` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 18, 2025, 2:49pm UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/6 "2025-02-18T14:49:29Z")
Hi @mtr_sw I recommend running some of the diagnostic command lines > **[Elastic Agent command reference | Fleet and Elastic Agent Guide \[8.17\] | Elastic](https://www.elastic.co/guide/en/fleet/current/elastic-agent-cmd-options.html)** I would start with `inspect` And please clarify, is this standalone mode or fleet managed? I'm not sure I'm clear on that ---
**Author:** ![mtr\_sw](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@mtr\_sw](https://discuss.elastic.co/u/mtr_sw)\ **Post date:** [February 19, 2025, 4:05pm UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/7 "2025-02-19T16:05:22Z")
Hi Stephen, we are using the elastic agent which is managed by the fleet. when executing `elastic-agent inspect` command I get the output to be: ```auto outputs: default: hosts: http://elasticsearch:9200 password: preset: balanced type: elasticsearch username: elastic ``` But I expected by specifying the Environment variables: ```auto ELASTICSEARCH_HOST=https://.fleet.privatelink.westeurope.azure.elastic-cloud.com:443 FLEET_SERVER_HOST=https://.fleet.privatelink.westeurope.azure.elastic-cloud.com:443 FLEET_SERVER_ELASTICSEARCH_HOST=https://.fleet.privatelink.westeurope.azure.elastic-cloud.com:443 ``` to point out to my cloud instance instead. I also tried to do a manual enroll form the pod shell: `elastic-agent enroll https://.fleet.privatelink.westeurope.azure.elastic-cloud.com:443 --enrollment-token ` and I am getting the error: `Error: fail to enroll: fail to execute request to fleet-server: dial tcp [::1]:80: connect: connection refused` I want to mention that my agent resides behind a firewall which re-encrypts the SSL traffic with its own certificae, but the certificate is added inthe linux trust store. A curl to the same location seems ok: ```auto curl -v https://.fleet.privatelink.westeurope.azure.elastic-cloud.com:443 * Trying :443... * TCP_NODELAY set * Connected to .privatelink.westeurope.azure.elastic-cloud.com () port 443 (#0) * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-certificates.crt CApath: /etc/ssl/certs * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256 ``` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 19, 2025, 5:38pm UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/8 "2025-02-19T17:38:08Z")
> [@mtr\_sw](#): > > we are using the elastic agent which is managed by the fleet Check the default elasticseadch output Fleet \> settings ![Screenshot 2025-02-19 at 11.35.01 AM](https://us1.discourse-cdn.com/elastic/original/3X/4/f/4f82ac2296c5fc7bbc9e228b54ca257b1d8853c7.png) Then check the actual policy to make sure it is using the correct output ![Screenshot 2025-02-19 at 11.37.22 AM](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d1443f8000b1220171894bc632cd8e840df81c1b.png) when you use enrollment those are what are used ---
**Author:** ![mtr\_sw](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@mtr\_sw](https://discuss.elastic.co/u/mtr_sw)\ **Post date:** [February 20, 2025, 9:00am UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/9 "2025-02-20T09:00:03Z")
Hi Stephen, thanks for you answer, the settings in the Fleet do seem ok, Just want to mention that we have another 2 stages Q & P which use these settings successfully with the elastic agent version 8.16.1, but on D the newer image versions for the elastic image it does not work, it seems like the agent cannot reach the elastic cloud to pick up the settings from the elastic cloud. ---
**Author:** ![mtr\_sw](https://avatars.discourse-cdn.com/v4/letter/m/c5a1d2/32.png) [@mtr\_sw](https://discuss.elastic.co/u/mtr_sw)\ **Post date:** [April 3, 2025, 2:23pm UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/10 "2025-04-03T14:23:23Z")
HI all, I just want to let you know that we have updated from 8.16.1 to 8.17.4 in the end and the configuration from 8.16.1 worked without problems in 8.17.4, but apparently not in the 8.17.1