We've noticed that restarting the Elastic Agent or Kibana service results in outgoing requests to 169.254.169.254 on ports 80 and 443.
Does anyone know why these requests are made and whether this behavior can be disabled?
Thanks!
This is usually normal behavior. 169.254.169.254 is the standard cloud metadata endpoint that Elastic checks during startup to detect cloud environments. If you're running on-premises, the requests typically fail harmlessly.
If you'd like to stop them, check whether any cloud metadata or autodiscovery features are enabled in your Elastic Agent or Kibana configuration. Sharing your Elastic version and deployment environment would help narrow down the exact setting.
Thank you for your reply.
Ideally, we'd like to prevent these connections because they are blocked by other systems in our network, which results in unnecessary alerts.
Our environment is:
- Elastic Stack version: 9.4.3 (all components)
- Deployment: Self-hosted, running natively on Red Hat Enterprise Linux 9.8
In Kibana, we've already disabled Usage Collection under Stack Management, but that did not stop the requests.
Are there any other settings in Kibana or Elastic Agent that disable cloud metadata detection entirely, or is this behavior currently not configurable?
If I'm not wrong, in Kibana you need to disable the telemetry, change the setting telemetry.optIn to false in kibana.yaml as described in this documentation.
For Elastic Agent there is this issue on how to disable it.
Currently you cannot disable it on a setting, there is a workaround mentioned that may work for you, which is setting the variable BEATS_ADD_CLOUD_METADATA_PROVIDERS as below.
BEATS_ADD_CLOUD_METADATA_PROVIDERS=''