Duplicate Elastic Agent metrics → 409 conflicts in Logstash (.metrics-* only)

Elastic Stack Elastic Agent
1

Hello,

We are currently experiencing an issue with Fleet-managed Elastic Agent where metrics are being sent twice, resulting in 409 version conflict errors in Logstash. We have not been able to identify the cause of this duplication so far.

Our Setup

  • Fleet-managed Elastic Agents (Linux + Windows)

  • Two Logstash nodes as output (load-balanced)

  • Agent metrics enabled (“Collect agent metrics” in policy)

  • Metrics and logs use the same Logstash output (confirmed via agent diagnostics)

  • loadbalance: true for the Logstash output in agent configs (also confirmed via agent diagnostics)

Problem

.metrics-* data arriving at our Logstash nodes is consistently duplicated, causing 409 version conflict errors for every document.

Disabling “Collect agent metrics” eliminates both the metrics traffic and the duplication issue entirely. We also verified this using minimal agent policies without additional integrations to rule out accidental double-collection at the source.

Question

Is this a known issue with Elastic Agent metrics when using multiple Logstash output hosts with load balancing enabled, or are we possibly missing a configuration detail?

Any help would be greatly appreciated.

Thank you in advance!