Fleet Server Enroll failure

Elastic Stack Elastic Agent
1

Title: Fleet Server on External Ubuntu VM Fails to Bootstrap with ECK Deployment

Dear Community,

I hope you are doing well.

I am trying to deploy a standalone Fleet Server on an Ubuntu VM and connect it to my Elastic Stack, which is deployed on Kubernetes using the ECK Operator.

The Ubuntu VM has full connectivity to my Kubernetes environment, and I have generated all the required certificates for the Fleet Server. I can successfully install and enroll a regular Elastic Agent (with only the System integration) on the VM without any issues. However, when I install the same agent as a Fleet Server, the installation completes successfully, but the Fleet Server remains in the Updating state for some time before eventually going Offline.

While reviewing the Elastic Agent logs, I noticed that Fleet Server attempts to communicate with Elasticsearch using http://localhost:9200. This is unexpected because the installation command specifies my external Elasticsearch HTTPS endpoint, which is reachable from the VM. The Fleet Server policy in Kibana is also configured with the correct Elasticsearch output.

From what I can see:

  • The Fleet Server installation command points to the correct Elasticsearch endpoint.

  • The Elasticsearch endpoint is reachable from the Ubuntu VM.

  • The Fleet Server policy is assigned correctly.

  • The Fleet Server enrolls successfully but fails during the bootstrap/configuration stage.

Another behavior that seems unusual is that, after installing Fleet Server:

  • No elastic-agent.sock file is created.

  • No local YAML configuration file is generated.

  • The Fleet Server eventually goes offline after remaining in the Updating state.

By comparison, installing the Elastic Agent without the Fleet Server role works perfectly, and the agent stays healthy.

Has anyone encountered a similar issue or knows why Fleet Server would fall back to http://localhost:9200 instead of using the configured Elasticsearch output? Any guidance on what to investigate next would be greatly appreciated.

Thank you.

2

What are the outputs you have configured in Fleet > Settings > Outputs ?

Can you share a screenshot?

3

The outputs are configured correctly. I have escalated this issue to Elastic Support, and they have opened a support case for further investigation.

During the review of the Elastic Agent diagnostics, we observed that the output was pointing to http://localhost:9200, despite the configured outputs being correct. Elastic Support also created a new output with a new service token to override the existing configuration; however, this did not resolve the issue.Let's see when they will reply.

4

Exactly what do you have under

Fleet -> Settings -> Outputs

Screenshot 2026-07-27 at 9.04.21 AM
Screenshot 2026-07-27 at 9.04.21 AM3050×1264 251 KB

Screenshot 2026-07-27 at 9.04.26 AM
Screenshot 2026-07-27 at 9.04.26 AM1682×1580 260 KB

This is a common issue.

Also you did not share your fleet install commands.... if the install command and these setting are not consistent it can cause issues.

Hope you get it solved with support.

5

Hi Stephen,

Thank you for your instructions I was able to resolve the issue but issue was not related to output.

It appears the Elastic Agent behaves unexpectedly when it is enrolled as a Fleet Server. I verified that the outputs and all related configurations are correct. Unfortunately, I can't share screenshots because this is a production environment.

After some testing, I noticed that if I leave the Elastic Agent in its failed state for approximately 30–60 minutes, it eventually becomes healthy on its own. I tested this behavior over four days, and the result was consistent every time. On the initial installation, the agent remains in a failed state for 30–60 minutes before automatically becoming healthy.

Once it reaches the healthy state, everything works as expected. I successfully tested enrolling additional Elastic Agents, adding integrations, and sending data through this Fleet Server without any issues.