# Elastic agent / kibana http requests to 169.254.169.254 on startup **URL:** \ **Category:** Elastic Agent\ **Created:** [July 14, 2026, 6:21am UTC](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325 "2026-07-14T06:21:39Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![username456](https://avatars.discourse-cdn.com/v4/letter/u/a88e4f/32.png) [@username456](https://discuss.elastic.co/u/username456)\ **Post date:** [July 14, 2026, 6:21am UTC](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325/1 "2026-07-14T06:21:40Z")
We've noticed that restarting the **Elastic Agent** or **Kibana** service results in outgoing requests to **169.254.169.254** on ports **80** and **443**. Does anyone know why these requests are made and whether this behavior can be disabled? Thanks! ---
**Author:** ![username456](https://avatars.discourse-cdn.com/v4/letter/u/a88e4f/32.png) [@username456](https://discuss.elastic.co/u/username456)\ **Post date:** [July 14, 2026, 11:38am UTC](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325/3 "2026-07-14T11:38:25Z")
Thank you for your reply. Ideally, we'd like to prevent these connections because they are blocked by other systems in our network, which results in unnecessary alerts. Our environment is: - **Elastic Stack version:** 9.4.3 (all components) - **Deployment:** Self-hosted, running natively on Red Hat Enterprise Linux 9.8 In Kibana, we've already disabled **Usage Collection** under **Stack Management** , but that did not stop the requests. Are there any other settings in Kibana or Elastic Agent that disable cloud metadata detection entirely, or is this behavior currently not configurable? ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [July 14, 2026, 1:24pm UTC](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325/4 "2026-07-14T13:24:04Z")
> [@username456](#): > > Are there any other settings in Kibana or Elastic Agent that disable cloud metadata detection entirely, or is this behavior currently not configurable? If I'm not wrong, in Kibana you need to disable the telemetry, change the setting `telemetry.optIn` to `false` in `kibana.yaml` as described in this [documentation](https://www.elastic.co/docs/reference/kibana/configuration-reference/telemetry-settings). For Elastic Agent there is this [issue](https://github.com/elastic/elastic-agent/issues/4670) on how to disable it. Currently you cannot disable it on a setting, there is a workaround mentioned that may work for you, which is setting the variable `BEATS_ADD_CLOUD_METADATA_PROVIDERS` as below. ```auto BEATS_ADD_CLOUD_METADATA_PROVIDERS='' ``` ---
**Author:** ![username456](https://avatars.discourse-cdn.com/v4/letter/u/a88e4f/32.png) [@username456](https://discuss.elastic.co/u/username456)\ **Post date:** [July 15, 2026, 7:41am UTC](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325/5 "2026-07-15T07:41:44Z")
Thanks for the information Leandro! For Elastic Agent, setting the `BEATS_ADD_CLOUD_METADATA_PROVIDERS=''` environment variable seems to have resolved the issue. Is there also a way to configure this environment variable centrally through Fleet so it applies to all managed agents? However, Kibana is still making connections to `169.254.169.254`. So far I've tried the following without success: - Environment variable: - `kibana.yml`: - Disabled telemetry in **Advanced Settings** within Kibana. Despite these changes, Kibana still attempts to connect to the metadata endpoint during startup. Is cloud metadata detection in Kibana currently hardcoded, or is there another setting to disable these requests?