# Elastic agent install error: already installed at: /opt/Elastic/Agent **URL:** \ **Category:** Elastic Agent\ **Created:** [March 17, 2023, 11:03am UTC](https://discuss.elastic.co/t/elastic-agent-install-error-already-installed-at-opt-elastic-agent/327926 "2023-03-17T11:03:16Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Nicolas\_Pelletier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicolas_pelletier/32/118570_2.png) [@Nicolas\_Pelletier](https://discuss.elastic.co/u/Nicolas_Pelletier)\ **Post date:** [March 17, 2023, 11:03am UTC](https://discuss.elastic.co/t/elastic-agent-install-error-already-installed-at-opt-elastic-agent/327926/1 "2023-03-17T11:03:16Z")
Hello, I'm trying to enroll an agent on a healthy fleet server which is also an agent (what i've understood). ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d38fce4ad92d7a0cf396c0621f15b857d4dc0ee8.png) I'm following the step by step guide from kibana interface in integration panel (see the image below) I've got the following error when i follow the command from the kibana interface: 3) Install Elastic Agent on your host: ```auto nicop@nicop-IdeaPad-5-Pro-14ARH7:~/elastic-agent-8.6.2-linux-x86_64$ sudo ./elastic-agent install --url=http://127.0.0.1:8220 --enrollment-token=TzZPNDdvWUIxYnhnNWdaOXpwSlI6bjhFNV9DaHVUY0szRUpXXXXXXX== Error: already installed at: /opt/Elastic/Agent For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.6/fleet-troubleshooting.html ``` Here is the output of `sudo netstat -tulpn | grep LISTEN` comand: ```auto tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 965/mariadbd tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 612/systemd-resolve tcp 0 0 0.0.0.0:9300 0.0.0.0:* LISTEN 25352/docker-proxy tcp 0 0 0.0.0.0:9600 0.0.0.0:* LISTEN 25579/docker-proxy tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1007/cupsd tcp 0 0 127.0.0.1:8221 0.0.0.0:* LISTEN 36713/fleet-server tcp 0 0 0.0.0.0:9200 0.0.0.0:* LISTEN 25370/docker-proxy tcp 0 0 0.0.0.0:50000 0.0.0.0:* LISTEN 25538/docker-proxy tcp 0 0 127.0.0.1:6791 0.0.0.0:* LISTEN 36277/elastic-agent tcp 0 0 127.0.0.1:6789 0.0.0.0:* LISTEN 36277/elastic-agent tcp 0 0 127.0.0.1:6666 0.0.0.0:* LISTEN 861/python tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 876/redis-server 12 tcp 0 0 127.0.0.1:6463 0.0.0.0:* LISTEN 5417/Discord --type tcp 0 0 0.0.0.0:5601 0.0.0.0:* LISTEN 25519/docker-proxy tcp 0 0 0.0.0.0:5044 0.0.0.0:* LISTEN 25601/docker-proxy ``` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 18, 2023, 4:33am UTC](https://discuss.elastic.co/t/elastic-agent-install-error-already-installed-at-opt-elastic-agent/327926/2 "2023-03-18T04:33:07Z")
Hi @Nicolas_Pelletier Welcome to the community! Since it looks like your are doing this all on one host / laptop just add another integration to the fleet policy... Not adding a whole another agent. Just 1 agent per host with Multiple integrations Fleet happens to be 1 integration... A special one but it technically just an integration... So try to just add another integration from the Fleet - Agent - Fleet Policy... add another integration to that policy, you can rename the policy if you like. In a normal use case you would be installing Fleet on one host and the installing/ using the agent to ship telemetry from other hosts.. but you are doing an all in one.... Hope this makes sense ---
**Author:** ![Nicolas\_Pelletier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicolas_pelletier/32/118570_2.png) [@Nicolas\_Pelletier](https://discuss.elastic.co/u/Nicolas_Pelletier)\ **Post date:** [March 18, 2023, 10:17am UTC](https://discuss.elastic.co/t/elastic-agent-install-error-already-installed-at-opt-elastic-agent/327926/3 "2023-03-18T10:17:14Z")
Hello Stephen, Thanks for your answer, What i'm trying to do is to integrate IOC's from MISP into ELK to take advantage of the Kibana dashboard . Here are the integration policies that i've combined in an agent policy. ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/3/b3fcd543904fbf2364bc344d86b615f998f384fc.png) So the next thing i need to do if i understand clearly is to create either a fleet server that play the role of an agent with this policies included or a standalone agent with these polices included as well. Which one do you think it's the best for my use case (benefit from the MISP and Threat utilities dashboard) ? **----------- Post Update ------------** So once i've connect the fleet server to Kibana it's the only thing that i need to do ? The MISP and Threat intelligence Utilities integration policies are attach the fleet-server-policy. ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/8/48d5c78f249c992f15a5cd70537279050fd5ae85.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [March 18, 2023, 2:42pm UTC](https://discuss.elastic.co/t/elastic-agent-install-error-already-installed-at-opt-elastic-agent/327926/4 "2023-03-18T14:42:44Z")
Either way but just 1 agent per host... Just to clarify so terminology > [@Nicolas\_Pelletier](#): > > or a standalone agent with these polices included as well. You will install an additional fleet managed agent on another host. The term _standalone_ in the context of Elastic Agent mean non-fleet managed A common architecture is to put the fleet server on the same server as Kibana or on a separate VM it is not typically on the agent where the source is I am not an expert on MISP perhaps someone else is or open a separate topic just on that. ---
**Author:** ![Nicolas\_Pelletier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nicolas_pelletier/32/118570_2.png) [@Nicolas\_Pelletier](https://discuss.elastic.co/u/Nicolas_Pelletier)\ **Post date:** [March 18, 2023, 4:32pm UTC](https://discuss.elastic.co/t/elastic-agent-install-error-already-installed-at-opt-elastic-agent/327926/5 "2023-03-18T16:32:36Z")
Thank you for your answer and all these precisions. Unfortunately i can't see any logs from the fleet server with the following integrations. ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/2/d20c955ca333a4968d689f25f8f8b18f07724037.png) When i look at log of elastic agent (which have the fleet server policy) i see these error logs: ```auto {"log.level":"error","@timestamp":"2023-03-18T17:20:51.271+0100","message":"Failed to connect to backoff(elasticsearch(http://elasticsearch:9200)): Get \"http://elasticsearch:9200\": lookup elasticsearch: Temporary failure in name resolution","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"beat/metrics-monitoring","type":"beat/metrics"} {"log.level":"error","@timestamp":"2023-03-18T17:20:51.272+0100","message":"Error dialing lookup elasticsearch: Temporary failure in name resolution" ``` It seems that the elastic Agent can't communicate with Elasticsearch. Do you know if there is any config file where we can change the elasticsearch host from `http://elasticsearch:9200` to `http://localhost:9200 ` ? It seems according to the [documentation of elastic-agent configuration](https://www.elastic.co/guide/en/fleet/current/elastic-agent-reference-yaml.html) that in the elastic-agent.reference.yml file there is an output part that can do that: ```auto ###################################### # Fleet configuration ###################################### outputs: default: type: elasticsearch hosts: [127.0.0.1:9200] api-key: "example-key" # username: "elastic" # password: "changeme" inputs: ``` But i don't see this part in the `/opt/Elastic/Agent/elastic-agent.yml`. Is it because it's an elastic agent with a fleet-server policy attach to it ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 15, 2023, 4:32pm UTC](https://discuss.elastic.co/t/elastic-agent-install-error-already-installed-at-opt-elastic-agent/327926/6 "2023-04-15T16:32:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.