/scl/fo/donwkkvwupncg2e7zipic/ABQvBPn6LYxCflx-3j7bRQ8?rlkey=yd3vhfy4ejxqc6c1n5xit7pa8&st=3sn6l6ir&dl=0
```
And agent log says:
```auto
Failed to dispatch action id "policy:eck-agent:1" of type "POLICY_CHANGE", error: validating Fleet client config: validating fleet client config: fail to communicate with Fleet Server API client hosts: all hosts failed: requester 0/1 to host https://fleet-server.elasticsearch.svc:9200/ errored: Get "https://fleet-server.elasticsearch.svc:9200/api/status?": lookup fleet-server.elasticsearch.svc on 10.152.183.10:53: no such host"
```
But you can see my kibana.yaml at the root post, the fleet\_server.hosts has been modified.
It should be "fleet-server-agent-http.elasticsearch.svc:8220" … i think …
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [December 28, 2025, 7:42am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265/6 "2025-12-28T07:42:10Z")
After you have the fleet server loaded
Go the
Kibana - Fleet - settings
And check the Fleet and Elasticsearch hosts:ports and make sure they are correct, they get pulled down by the policies.
See
> [@Breaking changes between elastic agent 8.16.1 and 8.16.3](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219/8):
>
> Check the default elasticseadch output Fleet \> settings Then check the actual policy to make sure it is using the correct output when you use enrollment those are what are used
---
### Author:  [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)
#### Post date: [December 28, 2025, 9:31am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265/7 "2025-12-28T09:31:10Z")
Thank you for your reply. Here is my settings:
---
### Author:  [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)
#### Post date: [December 28, 2025, 9:32am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265/8 "2025-12-28T09:32:09Z")
Another setting~
---
### Author:  [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)
#### Post date: [December 28, 2025, 1:53pm UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265/9 "2025-12-28T13:53:46Z")
Oh I got it! The agents pulled down the same id policies but legacy version. I will try to setup the agents to pull the latest policies tomorrow.
---
### Author:  [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)
#### Post date: [December 29, 2025, 5:16am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265/10 "2025-12-29T05:16:51Z")
🥲 I try to use the latest policies by changing the policies id, but it still not work, and the fleet-server even failed to start.
First
```auto
kubectl delete -f elasticsearch/elastic-agent.yaml -f elasticsearch/kibana.yaml -f elasticsearch/fleet-server.yaml
```
Second
Change policies id. Now they are suffix with “-2”
```yaml
apiVersion: kibana.k8s.elastic.co/v1
kind: Kibana
metadata:
name: kibana-cluster
namespace: elasticsearch
spec:
version: 8.19.9
count: 1
elasticsearchRef:
name: elasticsearch-cluster
config:
xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-cluster-es-http.elasticsearch.svc:9200"]
xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.elasticsearch.svc:8220"]
xpack.fleet.packages:
- name: system
version: latest
- name: elastic_agent
version: latest
- name: fleet_server
version: latest
xpack.fleet.agentPolicies:
- name: Fleet Server on ECK policy 2 # <---- Change is here
id: eck-fleet-server-2 # <---- Change is here
namespace: elasticsearch
is_managed: true
monitoring_enabled:
- logs
unenroll_timeout: 900
package_policies:
- name: fleet_server-2 # <---- Change is here
id: fleet_server-2 # <---- Change is here
package:
name: fleet_server
- name: Elastic Agent on ECK policy 2 # <---- Change is here
id: eck-agent-2 # <---- Change is here
namespace: elasticsearch
is_managed: true
monitoring_enabled:
- logs
unenroll_timeout: 900
package_policies:
- name: system-2 # <---- Change is here
id: system-2 # <---- Change is here
package:
name: system
podTemplate:
spec:
imagePullSecrets:
- name: harbor
containers:
- name: kibana
resources:
limits:
memory: 4Gi
cpu: 2
requests:
memory: 2Gi
cpu: 1
```
```yaml
apiVersion: agent.k8s.elastic.co/v1alpha1
kind: Agent
metadata:
name: fleet-server
namespace: elasticsearch
spec:
version: 8.19.9
elasticsearchRefs:
- name: elasticsearch-cluster
kibanaRef:
name: kibana-cluster
mode: fleet
fleetServerEnabled: true
policyID: eck-fleet-server-2 # <---- Change is here
deployment:
replicas: 1
podTemplate:
spec:
serviceAccountName: elastic-agent
automountServiceAccountToken: true
securityContext:
runAsUser: 0
imagePullSecrets:
- name: harbor
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: elastic-agent
rules:
- apiGroups: [""] # "" indicates the core API group
resources:
- pods
- nodes
- namespaces
verbs:
- get
- watch
- list
- apiGroups: ["coordination.k8s.io"]
resources:
- leases
verbs:
- get
- create
- update
- apiGroups: ["apps"]
resources:
- replicasets
verbs:
- list
- watch
- apiGroups: ["batch"]
resources:
- jobs
verbs:
- list
- watch
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: elastic-agent
namespace: elasticsearch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: elastic-agent
subjects:
- kind: ServiceAccount
name: elastic-agent
namespace: elasticsearch
roleRef:
kind: ClusterRole
name: elastic-agent
apiGroup: rbac.authorization.k8s.io
```
Then
```auto
# Exec first
kubectl apply -f elasticsearch/kibana.yaml
# exec second
kubectl apply -f elasticsearch/fleet-server.yaml
```
Fleet server log ends with:
```auto
Error: fleet-server failed: timed out waiting for Fleet Server to start after 2m0s
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.19/fleet-troubleshooting.html
Error: enrollment failed: exit status 1
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.19/fleet-troubleshooting.html
```
Full log is here:
```auto
# Please replace "_dropdown_" ...
_dropdown_/scl/fi/l90t6efu0mgq1u7g2ydt9/fleet-2.log?rlkey=149vh2he7g4d6s3q6hevu8on4&st=v63gnlyk&dl=0
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [December 29, 2025, 3:34pm UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265/11 "2025-12-29T15:34:04Z")
If you look at the logs and search for `error` or `warn`
It looks like your elasticsearch output is not set correctly
`error.message":"dial tcp [::1]:9200: connect: connection refused"...`
It looks like it is trying to reach `tcp [::1]:9200``"localhost:9200"`
Same as the fleet host is the Elasticsearch Host Set Correctly in the Kibana - Fleet settings
```auto
{"log.level":"error","@timestamp":"2025-12-29T05:08:50.372Z","message":"failed to fetch elasticsearch version","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","error.message":"dial tcp [::1]:9200: connect: connection refused","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-12-29T05:08:50.372Z","message":"Failed Elasticsearch output configuration test, using bootstrap values.","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","error.message":"dial tcp [::1]:9200: connect: connection refused","output":{"Elasticsearch":{"Headers":null,"Hosts":["localhost:9200"],"MaxConnPerHost":128,"MaxContentLength":104857600,"MaxRetries":3,"Path":"","Protocol":"https","ProxyDisable":false,"ProxyHeaders":{},"ProxyURL":"","ServiceToken":"[redacted]","ServiceTokenPath":"","TLS":{"CASha256":null,"CATrustedFingerprint":"","CAs":["/mnt/elastic-internal/elasticsearch-association/elasticsearch/elasticsearch-cluster/certs/ca.crt"],"Certificate":{"Certificate":"","Key":"","Passphrase":"","PassphrasePath":""},"CipherSuites":null,"CurveTypes":null,"Enabled":null,"Renegotiation":"never","VerificationMode":"full","Versions":null},"Timeout":90000000000},"Extra":null},"ecs.version":"1.6.0"}
```
This Warning Log is explicit... `"Hosts":["localhost:9200"]`
```auto
{"log.level":"warn","@timestamp":"2025-12-29T05:08:50.372Z",
"message":"Failed Elasticsearch output configuration test, using bootstrap values.",
"component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},
"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server",
"error.message":"dial tcp [::1]:9200: connect: connection refused", <<<< HERE
"output":{"Elasticsearch":{"Headers":null,"Hosts":["localhost:9200"], <<<< HERE
....
```
Curious if you used our documentation or something else? ...
Pretty Sure if you just followed the quickstart carefully this should all work.
> **[Quickstart: Running Fleet on Elastic Cloud on Kubernetes | Elastic Docs](https://www.elastic.co/docs/deploy-manage/deploy/cloud-on-k8s/quickstart-fleet)**
>
> To deploy Fleet Server, Elastic Agents, Elasticsearch, and Kibana, apply the following specification:. Check Configuration Examples for more ready-to-use...
If I get a chance I will try...
---
### Author:  [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)
#### Post date: [December 30, 2025, 2:43am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265/12 "2025-12-30T02:43:19Z")
Yes, i used this quickstart you say. but i'm not direct copy and paste, i modified the fleet-server host to a wrong address. 🥲 so this post begin is here.
And now i have give up. i deleted all resources in my elasticsearch namespace, include the elasticsearch instance. and check my manifest all right, then re-apply them. It works now.
I think the configuration stored in somewhere starts wrong because my modification, and can not be fixed thought the subsequently yaml modification and delete~ apply~ delete~ apply~.
I tried to find the origin configuration data, i checked elasticsearch indexes and data stream, finally I couldn't find them.
So, this is the finally question of this post 😂
Where the fleet-server configuration stored in? You see my kibana yaml already changed and applied, and the fleet-server hosts shown on the UI are right too. So, where does fleet-server agent read the configuration from?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [December 30, 2025, 3:42am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265/13 "2025-12-30T03:42:12Z")
> [@NiceAgent](#):
>
> Where the fleet-server configuration stored in?
They are stored as as any other kubernetes manifests
I am not familiar with microk8s
> [@NiceAgent](#):
>
> I tried to find the origin configuration data, i checked elasticsearch indexes and data stream, finally I couldn't find them.
The manifests are stored in kubernetes not Elasticsearch.
Eventually the configurations are loaded into elastic such as those fleet endpoints but you can not access them directly you would need to use the REST API
I don't know if it's the order of operations or that kubernetes environment is different. But I always do delete and reapply not just overwrite when I'm debugging.
Not sure what to tell you