Change grpc port to 6788 on fleet controled agent

Elastic Stack Elastic Agent
1

Hello,

i want to install UniFi OS Server on my windows server.

Unfortunately the elastic agent is using port 6789.

I wonder if i can change this with a dedicated policy for this server?

seems like agent.grpc.port: 6788 is the right setting.

How could i implement this change?

If i disable the elastic agent the UniFi OS Server can boot.

2

Yes, it's possible if your Elastic Agent supports changing agent.grpc.port. If you're using Fleet, update the setting in the agent policy and restart the agent. Are you using a Fleet-managed or standalone agent?

3

Thanks @cartergray234 .

I wonder where i can find this setting? I checked the configuration (settings) of the policy more than one time but somehow i can not find the right place to change it?

Can you assist me please?

4

Hmmm @GKre

For fleet managed The only place I think you can see then is in the Policy although not all setting will work so you will need to try and see.

Its at he very bottom

Advanced internal YAML settings

Control advanced agent internal settings and feature flags. No stability guarantee is provided for these settings.

Screenshot 2026-07-18 at 8.09.45 AM
Screenshot 2026-07-18 at 8.09.45 AM2922×1130 265 KB

Screenshot 2026-07-18 at 8.09.50 AM
Screenshot 2026-07-18 at 8.09.50 AM2924×598 49.6 KB

5

sorry for missing the information - i am using fleet.

The advanced internal YAML setting seems to be the point to change this config.
I found a note on github - maybe the solution is documented there:

thx for helping.

6

Hi @GKre

Good Find... so did you try the way I showed does that work?

It would be to confirm whether that works or not.

It looks like if you add it where I said and add it like this

agent.grpc:
  address: localhost
  port: 16788

That is should work ... I just tested and when I ran

elastic-agent inspect

I see...

    internal:
      agent.grpc:
        address: localhost
        port: 16788

Perhaps that is easier and repeatable way

7

thank you stephenb.
this was the missing point as i did not know the right syntax for the change. I will give it a try and report the result.

8

seems like it does not work - the agent is using 6789:
netstat -ano | findstr :6788
netstat -ano | findstr :6789
TCP 127.0.0.1:6789 0.0.0.0:0 ABHÖREN 2896
TCP 127.0.0.1:6789 127.0.0.1:49807 HERGESTELLT 2896
TCP 127.0.0.1:6789 127.0.0.1:49809 HERGESTELLT 2896
TCP 127.0.0.1:6789 127.0.0.1:49925 HERGESTELLT 2896
TCP 127.0.0.1:6789 127.0.0.1:50027 HERGESTELLT 2896
TCP 127.0.0.1:49807 127.0.0.1:6789 HERGESTELLT 7120
TCP 127.0.0.1:49809 127.0.0.1:6789 HERGESTELLT 6376
TCP 127.0.0.1:49925 127.0.0.1:6789 HERGESTELLT 5856
TCP 127.0.0.1:50027 127.0.0.1:6789 HERGESTELLT 996

And yes - i checked that the setting is active and rebootet the server.

9

Yup you are correct my approach does not work ...

When I run elastic agent inspect after changing the elastic-agent.yml I see this

agent:
  download:
    sourceURI: https://artifacts.elastic.co/downloads/
  features: null
  grpc:
    address: localhost
    port: 16788. <<<< Correct 
  headers: null
  id: c209975b-a937-4bd0-8645-56b9bb9f1dfc
  internal:
    agent:
      grpc:
        address: localhost
        port: 16788 <<< Not Correct where my fix put it