If we have a fleet agent installed and then that agent goes offline with no “line of sight” to the elasticsearch/fleet server, how are events handled that are captured through integrations. Say you had an ubuntu host with elastic defend enabled and auditd integration enabled. How long would those ev…

Elastic Agent offline caching of events

craigothy October 23, 2025, 7:03pm 7

Do you have a reference where that queue size is controlled? Thank you very much.

Topic		Replies	Views
Elastic Agent filling up disk space with logs, disaster Endpoint Security	7	2878	July 26, 2021
Buffer between logstash and elasticsearch Logstash	2	1626	July 6, 2017
Huge size for elastic endpoint (defend) integration indices? Endpoint Security	5	856	March 27, 2023
Buffer data in Logstash if Elasticsearch is down Logstash	6	4630	July 6, 2017
Elastic agent does not send logs Elastic Security fleet	8	2684	September 28, 2021

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Elastic Agent offline caching of events

Related topics