Hello,
I’m trying to install fleet server on windows but im running into an error
Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)
As soon as the powershell command stops, it deletes the whole folder where the
Elastic/Agent
is installed, but I have managed to copy the logs during
Waiting For Enroll
step.
full log for “elastic-agent-1.ndjson”
{"log.level":"info","@timestamp":"2025-09-04T12:07:40.153+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":193},"message":"Elastic Agent started","log":{"source":"elastic-agent"},"process.pid":13908,"agent.version":"9.0.3","agent.unprivileged":false,"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:40.369+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.InvokeWatcher","file.name":"upgrade/rollback.go","file.line":154},"message":"Starting upgrade watcher","log":{"source":"elastic-agent"},"path":"D:\\ELK_9.0.3\\Elastic\\Agent\\elastic-agent.exe","args":["D:\\ELK_9.0.3\\Elastic\\Agent\\elastic-agent.exe","watch","--path.config","D:\\ELK_9.0.3\\Elastic\\Agent","--path.home","D:\\ELK_9.0.3\\Elastic\\Agent"],"env":[],"dir":"","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.367+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.InvokeWatcher","file.name":"upgrade/rollback.go","file.line":168},"message":"Upgrade Watcher invoked","log":{"source":"elastic-agent"},"agent.upgrade.watcher.process.pid":9372,"agent.process.pid":13908,"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.375+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.runElasticAgent","file.name":"cmd/run.go","file.line":282},"message":"APM instrumentation disabled","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.379+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":73},"message":"Gathered system information","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.396+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":79},"message":"Detected available inputs and outputs","log":{"source":"elastic-agent"},"inputs":["containerd/metrics","syncgateway/metrics","statsd/metrics","audit/file_integrity","gcp-pubsub","haproxy/metrics","rabbitmq/metrics","sql/metrics","stan/metrics","vsphere/metrics","syslog","filestream","mongodb/metrics","postgresql/metrics","oracle/metrics","activemq/metrics","etw","unifiedlogs","cloudfoundry/metrics","log","redis","mqtt","azure-eventhub","benchmark","cel","elasticsearch/metrics","zookeeper/metrics","osquery","aws/metrics","httpjson","synthetics/http","mysql/metrics","uwsgi/metrics","etcd/metrics","gcp/metrics","endpoint","salesforce","mssql/metrics","jolokia/metrics","meraki/metrics","openai/metrics","http_endpoint","udp","docker/metrics","apache/metrics","traefik/metrics","o365audit","cloudfoundry","gcs","iis/metrics","nats/metrics","prometheus/metrics","docker","synthetics/browser","redis/metrics","http/metrics","kafka/metrics","apm","fleet-server","synthetics/icmp","kubernetes/metrics","system/metrics","panw/metrics","packet","kafka","nginx/metrics","lumberjack","audit/auditd","container","kibana/metrics","logstash/metrics","awsfargate/metrics","memcached/metrics","netflow","aws-cloudwatch","aws-s3","azure-blob-storage","entity-analytics","journald","streaming","synthetics/tcp","cometd","tcp","unix","winlog","beat/metrics","linux/metrics","windows/metrics","azure/metrics","audit/system"],"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.396+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/capabilities.LoadFile","file.name":"capabilities/capabilities.go","file.line":48},"message":"Capabilities file not found in D:\\ELK_9.0.3\\Elastic\\Agent\\capabilities.yml","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.396+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":85},"message":"Determined allowed capabilities","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.396+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":100},"message":"Loading baseline config from D:\\ELK_9.0.3\\Elastic\\Agent\\elastic-agent.yml","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.651+0300","log.origin":{"function":"github.com/elastic/elastic-agent/pkg/component/runtime.NewManager","file.name":"runtime/manager.go","file.line":164},"message":"GRPC comms socket listening at localhost:6789","log":{"source":"elastic-agent"},"address":"localhost:6789","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.660+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application.New","file.name":"application/application.go","file.line":176},"message":"Parsed configuration and determined agent is in Fleet Server bootstrap mode","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.667+0300","log.logger":"control","log.origin":{"function":"github.com/elastic/elastic-agent/pkg/control/v2/server.(*Server).Start","file.name":"server/server.go","file.line":91},"message":"GRPC control socket listening at npipe:///elastic-agent-system","log":{"source":"elastic-agent"},"address":"npipe:///elastic-agent-system","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.668+0300","log.origin":{"function":"github.com/elastic/elastic-agent/pkg/component/runtime.(*Manager).Run","file.name":"runtime/manager.go","file.line":226},"message":"Starting grpc control protocol listener on port 6789 with max_message_size 104857600","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.671+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/upgrade.(*Upgrader).Reload","file.name":"upgrade/upgrade.go","file.line":127},"message":"Source URI changed from \"https://artifacts.elastic.co/downloads/\" to \"https://artifacts.elastic.co/downloads/\"","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.671+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/monitoring/reload.(*ServerReloader).Start","file.name":"reload/reload.go","file.line":54},"message":"Starting monitoring server with cfg &config.MonitoringConfig{Enabled:true, MonitorLogs:true, MonitorMetrics:true, MetricsPeriod:\"\", FailureThreshold:(*uint)(nil), LogMetrics:true, HTTP:(*config.MonitoringHTTPConfig)(0xc000ec75f0), Namespace:\"default\", Pprof:(*config.PprofConfig)(nil), MonitorTraces:false, APM:config.APMConfig{Environment:\"\", APIKey:\"\", SecretToken:\"\", Hosts:[]string(nil), GlobalLabels:map[string]string(nil), TLS:config.APMTLS{SkipVerify:false, ServerCertificate:\"\", ServerCA:\"\"}, SamplingRate:(*float32)(nil)}, Diagnostics:config.Diagnostics{Uploader:config.Uploader{MaxRetries:10, InitDur:1000000000, MaxDur:600000000000}, Limit:config.Limit{Interval:60000000000, Burst:1}}, RuntimeManager:\"process\"}","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.671+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/monitoring.NewServer.exposeMetricsEndpoint.func1","file.name":"monitoring/server.go","file.line":96},"message":"creating monitoring API with cfg api.Config{Enabled:true, Host:\"http://localhost:6791\", Port:6791, User:\"\", SecurityDescriptor:\"\", Timeout:5000000000}","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.672+0300","log.logger":"api","log.origin":{"function":"github.com/elastic/elastic-agent-libs/api.(*Server).Start","file.name":"api/server.go","file.line":85},"message":"Starting stats endpoint","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.672+0300","log.logger":"api","log.origin":{"function":"github.com/elastic/elastic-agent-libs/api.(*Server).Start.func1","file.name":"api/server.go","file.line":87},"message":"Metrics endpoint listening on: 127.0.0.1:6791 (configured: http://localhost:6791)","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:07:56.673+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).refreshComponentModel","file.name":"coordinator/coordinator.go","file.line":1450},"message":"Updating running component model","log":{"source":"elastic-agent"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:08:11.954+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":676},"message":"Spawned new component fleet-server-default: Starting: spawned pid '22592'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:08:11.954+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":683},"message":"Spawned new unit fleet-server-default-fleet-server: Starting: spawned pid '22592'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"unit":{"id":"fleet-server-default-fleet-server","type":"input","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:08:11.954+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":683},"message":"Spawned new unit fleet-server-default: Starting: spawned pid '22592'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"STARTING"},"unit":{"id":"fleet-server-default","type":"output","state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.208Z","message":"Boot fleet-server","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","version":"9.0.3","commit":"a3e31b11","pid":22592,"exe":"D:\\ELK_9.0.3\\Elastic\\Agent\\data\\elastic-agent-9.0.3-5f1479\\components\\fleet-server.exe","ppid":13908,"args":["--agent-mode","-E","logging.level=debug","-E","logging.to_stderr=true","-E","path.data=D:\\ELK_9.0.3\\Elastic\\Agent\\data\\elastic-agent-9.0.3-5f1479\\run\\fleet-server-default"],"ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.211Z","message":"starting communication connection back to Elastic Agent","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:08:12.222+0300","log.logger":"component.runtime.fleet-server-default","log.origin":{"function":"github.com/elastic/elastic-agent/pkg/component/runtime.(*Manager).CheckinV2","file.name":"runtime/manager.go","file.line":693},"message":"control checkin v2 protocol has chunking enabled","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T12:08:12.222+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":696},"message":"Component state changed fleet-server-default (STARTING->HEALTHY): Healthy: communicating with pid '22592'","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"HEALTHY","old_state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.231Z","message":"Elasticsearch compatibility check successful","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"elasticsearch_version":"9.0.3","ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","fleet_version":"9.0.3","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.233Z","message":"Found settings with recommended ram.","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","memory_mb":32767,"recommended_mb":32384,"ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.233Z","message":"Setting cache config options","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","cfg":{"APIKeyJitter":300000000000,"APIKeyTTL":900000000000,"ActionTTL":300000000000,"ArtifactTTL":86400000000000,"EnrollKeyTTL":60000000000,"MaxCost":536870912,"NumCounters":6400000},"ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.238Z","message":"Starting","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"STARTING","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.238Z","message":"Found settings with recommended ram.","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","memory_mb":32767,"recommended_mb":32384,"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.238Z","message":"initial server configuration","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.238Z","message":"starting server on configuration change","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.238Z","message":"Run bulker with options","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"opts":{"apikeyMaxParallel":120,"apikeyMaxReqSize":104857600,"blockQueueSz":32,"flushInterval":250,"flushThresholdCnt":2048,"flushThresholdSz":1048576,"maxPending":8},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.243Z","message":"Elasticsearch compatibility check successful","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","fleet_version":"9.0.3","elasticsearch_version":"9.0.3","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.252Z","message":"starting index monitor","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","index":".fleet-policies","ctx":"index monitor","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.252Z","message":"run policy monitor","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","ctx":"policy agent monitor","burst":1,"service.type":"fleet-server","event_rate":4000,"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.252Z","message":"starting index monitor","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","index":".fleet-actions","ctx":"index monitor","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-09-04T09:08:12.253Z","message":"Exposed over insecure HTTP; enablement of TLS is strongly recommended","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.253Z","message":"Listening on localhost:8221","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-09-04T09:08:12.253Z","message":"Exposed over insecure HTTP; enablement of TLS is strongly recommended","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.253Z","message":"Listening on localhost:8220","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:12.763Z","message":"Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"DEGRADED","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-09-04T12:08:12.763+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":714},"message":"Unit state changed fleet-server-default-fleet-server (STARTING->DEGRADED): Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"HEALTHY"},"unit":{"id":"fleet-server-default-fleet-server","type":"input","state":"DEGRADED","old_state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2025-09-04T12:08:12.763+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":714},"message":"Unit state changed fleet-server-default (STARTING->DEGRADED): Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)","log":{"source":"elastic-agent"},"component":{"id":"fleet-server-default","state":"HEALTHY"},"unit":{"id":"fleet-server-default","type":"output","state":"DEGRADED","old_state":"STARTING"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:18.271Z","message":"Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.name":"fleet-server","service.type":"fleet-server","state":"DEGRADED","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:23.777Z","message":"Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","state":"DEGRADED","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-09-04T09:08:29.284Z","message":"Running on policy with Fleet Server integration: fleet-server-policy; missing config fleet.agent.id (expected during bootstrap process)","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"service.type":"fleet-server","state":"DEGRADED","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"}
Setup :
ELK Stack version : 9.0.3
OS : windows server 2019
Powershell trace :
PS D:\ELK_9.0.3\elastic-agent-9.0.3-windows-x86_64> .\elastic-agent.exe install --url=https://****:8220 `
>> --fleet-server-es=https://****:9200 `
>> --fleet-server-service-token=***** `
>> --fleet-server-policy=fleet-server-policy `
>> --fleet-server-port=8220 `
>> --base-path "D:/ELK_9.0.3" `
>> --insecure `
>> --fleet-server-es-insecure `
>> --fleet-server-insecure-http
fleet-server installation detected, using --install-servers flag
Elastic Agent will be installed at D:\ELK_9.0.3\Elastic\Agent and will run as a service. Do you want to continue? [Y/n]:y
[= ] Service Started [22s] Elastic Agent successfully installed, starting enrollment.
[=== ] Waiting For Enroll... [42s] {"log.level":"info","@timestamp":"2025-09-04T12:06:51.335+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.(*enrollCmd).daemonReloadWithBackoff","file.name":"cmd/enroll_cmd.go","file.line":497},"message":"Restarting agent daemon, attempt 0","ecs.version":"1.6.0"}
[ =] Waiting For Enroll... [44s] {"log.level":"info","@timestamp":"2025-09-04T12:06:53.339+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll_cmd.go","file.line":810},"message":"Waiting for Elastic Agent to start Fleet Server","ecs.version":"1.6.0"}
[====] Waiting For Enroll... [1m0s] {"log.level":"info","@timestamp":"2025-09-04T12:07:09.661+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll_cmd.go","file.line":793},"message":"Waiting for Elastic Agent to start","ecs.version":"1.6.0"}
[====] Waiting For Enroll... [1m56s] {"log.level":"info","@timestamp":"2025-09-04T12:08:05.666+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll_cmd.go","file.line":810},"message":"Waiting for Elastic Agent to start Fleet Server","ecs.version":"1.6.0"}
[=== ] Waiting For Enroll... [2m42s] Error: fleet-server failed: timed out waiting for Fleet Server to start after 2m0s
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/9.0/fleet-troubleshooting.html
{"log.level":"info","@timestamp":"2025-09-04T12:08:51.340+0300","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.waitForFleetServer.func1","file.name":"cmd/enroll_cmd.go","file.line":793},"message":"Waiting for Elastic Agent to start","ecs.version":"1.6.0"}
[== ] Uninstalled [2m43s] Error uninstalling. Printing logs
2025-09-04T09:08:51.881Z DEBUG [install] Loaded configuration from D:\ELK_9.0.3\elastic-agent-9.0.3-windows-x86_64\elastic-agent.yml
2025-09-04T09:08:51.881Z DEBUG [install] Merged configuration from D:\ELK_9.0.3\elastic-agent-9.0.3-windows-x86_64\elastic-agent.yml into result
2025-09-04T09:08:51.881Z DEBUG [install] Merged all configuration files from [D:\ELK_9.0.3\elastic-agent-9.0.3-windows-x86_64\elastic-agent.yml], no external input files
2025-09-04T09:08:52.034Z DEBUG [install] Loaded configuration from D:\ELK_9.0.3\elastic-agent-9.0.3-windows-x86_64\elastic-agent.yml
2025-09-04T09:08:52.034Z DEBUG [install] Merged configuration from D:\ELK_9.0.3\elastic-agent-9.0.3-windows-x86_64\elastic-agent.yml into result
2025-09-04T09:08:52.034Z DEBUG [install] Merged all configuration files from [D:\ELK_9.0.3\elastic-agent-9.0.3-windows-x86_64\elastic-agent.yml], no external input files
2025-09-04T09:08:52.034Z DEBUG [install.composable] Starting controller for composable inputs
2025-09-04T09:08:52.034Z DEBUG [install.composable] Started controller for composable inputs
2025-09-04T09:08:52.034Z DEBUG [install.composable] Computing new variable state for composable inputs
2025-09-04T09:08:52.034Z DEBUG [install.composable] Stopping controller for composable inputs
2025-09-04T09:08:52.034Z DEBUG [install.composable] Stopped controller for composable inputs
Error: enroll command failed for unknown reason: exit status 1
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/9.0/fleet-troubleshooting.html
Note : I have tried to provide certificates (instead of running –insecure) before but ran into an error :
{"log.level":"error","@timestamp":"2025-09-03T09:21:15.003Z","message":"failed to fetch elasticsearch version","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-default","type":"fleet-server"},"log":{"source":"fleet-server-default"},"ecs.version":"1.6.0","service.name":"fleet-server","service.type":"fleet-server","error.message":"tls: failed to verify certificate: x509: certificate is valid for uccapplication.stc.com.sa, not localhost","ecs.version":"1.6.0"}
I’m also running all ELK components on the same machine.