# Elastic Agent stopped sending certain data streams

**URL:** <https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109>\
**Category:** Endpoint Security\
**Tags:** fleet\
**Created:** [March 12, 2021, 4:30pm UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109 "2021-03-12T16:30:34Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [March 12, 2021, 4:30pm UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109/1 "2021-03-12T16:30:34Z")

</div>

Hi,

I have deployed the agent along with the windows intergration. As part of this I wanted to collect Powershell logs.  
This was working fine however at 20:31:49.750 yestarday I received my last powershell log on the "windows.powershell" data.stream.

 ![power](https://us1.discourse-cdn.com/elastic/original/3X/8/7/87460326205b8dddf15fadf0b06fb4c380025ffc.png)

No changes were made on the host side or for the elastic agent or policy. I can not find any explanation or error codes around this.

I have also taken a look at a seperate instance and it seems that the same has occured there i.e. the data stream was up and functioning and after a certain point no more powershell logs have been shipped.

Can anyone advise on where to look for an explanation for this and a potential fix ?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![finbarr996](https://avatars.discourse-cdn.com/v4/letter/f/db5fbb/32.png) [@finbarr996](https://discuss.elastic.co/u/finbarr996)\
**Post date:** [March 15, 2021, 11:30am UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109/2 "2021-03-15T11:30:02Z")

</div>

Hi there,  
Is it just this one stream that has stopped shipping, or has everything from that particular host also stopping coming in?

---

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [March 16, 2021, 12:07pm UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109/3 "2021-03-16T12:07:55Z")

</div>

Hi @finbarr996 ,

The I am still getting other streams from the device, the local Powershell logs are also still being crated on the host.

Luke

---

<div class="post-metadata">

**Author:** ![finbarr996](https://avatars.discourse-cdn.com/v4/letter/f/db5fbb/32.png) [@finbarr996](https://discuss.elastic.co/u/finbarr996)\
**Post date:** [March 18, 2021, 12:48am UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109/4 "2021-03-18T00:48:33Z")

</div>

Okay - sorry, in that case I can't assist, it's beyond my skill level.  
If you do figure out the answer, do please post it here.

Cheers,  
John.

---

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [April 1, 2021, 8:31am UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109/5 "2021-04-01T08:31:14Z")

</div>

Hi @finbarr996 ,

no need to apologies, i appreciate you taking the time to ask the questions 🙂 .

---

<div class="post-metadata">

**Author:** ![The1WhoPrtNocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/the1whoprtnocks/32/72685_2.png) [@The1WhoPrtNocks](https://discuss.elastic.co/u/The1WhoPrtNocks)\
**Post date:** [April 6, 2021, 2:44pm UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109/6 "2021-04-06T14:44:55Z")

</div>

For anyone who stumbles across this the issue seems to have been fixed by upgrading from 7.10.1 to 7.12.0 .

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 4, 2021, 2:45pm UTC](https://discuss.elastic.co/t/elastic-agent-stopped-sending-certain-data-streams/267109/7 "2021-05-04T14:45:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
