Elastic agent / kibana http requests to 169.254.169.254 on startup

Elastic Stack Elastic Agent
1

We've noticed that restarting the Elastic Agent or Kibana service results in outgoing requests to 169.254.169.254 on ports 80 and 443.

Does anyone know why these requests are made and whether this behavior can be disabled?

Thanks!

3

Thank you for your reply.

Ideally, we'd like to prevent these connections because they are blocked by other systems in our network, which results in unnecessary alerts.

Our environment is:

  • Elastic Stack version: 9.4.3 (all components)
  • Deployment: Self-hosted, running natively on Red Hat Enterprise Linux 9.8

In Kibana, we've already disabled Usage Collection under Stack Management, but that did not stop the requests.

Are there any other settings in Kibana or Elastic Agent that disable cloud metadata detection entirely, or is this behavior currently not configurable?

4

If I'm not wrong, in Kibana you need to disable the telemetry, change the setting telemetry.optIn to false in kibana.yaml as described in this documentation.

For Elastic Agent there is this issue on how to disable it.

Currently you cannot disable it on a setting, there is a workaround mentioned that may work for you, which is setting the variable BEATS_ADD_CLOUD_METADATA_PROVIDERS as below.

BEATS_ADD_CLOUD_METADATA_PROVIDERS=''
5

Thanks for the information Leandro!

For Elastic Agent, setting the BEATS_ADD_CLOUD_METADATA_PROVIDERS='' environment variable seems to have resolved the issue. Is there also a way to configure this environment variable centrally through Fleet so it applies to all managed agents?

However, Kibana is still making connections to 169.254.169.254.

So far I've tried the following without success:

  • Environment variable:

    AWS_EC2_METADATA_DISABLED=true

  • kibana.yml:

    telemetry.optIn: false
telemetry.allowChangingOptInStatus: false
telemetry.enabled: false

  • Disabled telemetry in Advanced Settings within Kibana.

Despite these changes, Kibana still attempts to connect to the metadata endpoint during startup.

Is cloud metadata detection in Kibana currently hardcoded, or is there another setting to disable these requests?