# How to Configure Trust/Entitlements for Datadog APM Java Agent on Elasticsearch 9.X **URL:** \ **Category:** Elasticsearch\ **Created:** [October 31, 2025, 6:24am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119 "2025-10-31T06:24:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![flyxp11](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flyxp11/32/145584_2.png) [@flyxp11](https://discuss.elastic.co/u/flyxp11)\ **Post date:** [October 31, 2025, 6:24am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119/1 "2025-10-31T06:24:59Z")
1. Is the Datadog APM Java Agent officially supported for use with Elasticsearch 9.x? 2. What are the specifuc Entitlements(security permissions) required for the dd-java-agent.jar to run as a Java Agent on an Elasticsearch 9.x node? I have attached a stack trace/screenshot showing the exact error encountered during the Elasticsearch startup, which you may find helpful for your investigation. The error explicitly states: ENTITLEMENT [outbound\_network] not granted. This confirms that the Agent is being blocked from making necessary network connections due to the new security model. ![Image Pasted at 2025-10-31 09-28](https://us1.discourse-cdn.com/elastic/original/3X/0/4/04f4c665ef00feccb23bad9bdd787045b81ea966.jpeg) ---
**Author:** ![flyxp11](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flyxp11/32/145584_2.png) [@flyxp11](https://discuss.elastic.co/u/flyxp11)\ **Post date:** [November 3, 2025, 12:37am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119/2 "2025-11-03T00:37:22Z")
Regarding the problem above, has anyone experienced it? I earnestly request everyone's assistance. Thanks in advance for your help! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [November 3, 2025, 1:40am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119/3 "2025-11-03T01:40:59Z")
Hi @flyxp11 Welcome to the community. Perhaps read this as @DavidTurner recently answered > [@Elasticsearch WARN message after upgrade 8.19.2 to 8.19.3](https://discuss.elastic.co/t/elasticsearch-warn-message-after-upgrade-8-19-2-to-8-19-3/381460/2): > > The Dynatrace agent isn’t supported and we recommend not using it. See the warning in [these docs](https://www.elastic.co/docs/deploy-manage/deploy/self-managed/installing-elasticsearch#jvm-version) for more information: WARNING: Don’t use third-party Java agents that attach to the JVM. Such agents can be harmful to Elasticsearch stability and performance. In some cases they may cause nodes to freeze, crash, or fail to start up, or to lose or corrupt your data. I would assume the same would go for the DD Agent Specifically from the Docs Referenced > Warning > > Don’t use third-party Java agents that attach to the JVM. Such agents can be harmful to Elasticsearch stability and performance. In some cases they may cause nodes to freeze, crash, or fail to start up, or to lose or corrupt your data. ---
**Author:** ![flyxp11](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flyxp11/32/145584_2.png) [@flyxp11](https://discuss.elastic.co/u/flyxp11)\ **Post date:** [November 3, 2025, 2:36am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119/4 "2025-11-03T02:36:14Z")
Hi @stephenb ,Thank you for your previous response. Based on @DavidTurner's earlier answer, my understanding is that any third-party Java agent (including the Datadog agent) is not permitted to attach to the Elasticsearch JVM, as this could negatively impact the stability and performance of Elasticsearch. Is my understanding correct? If I wanted to have the Datadog agent as one of the plugins trusted by Elasticsearch, could it then be attached to the Elasticsearch JVM to monitor Elasticsearch? If I can not attach it to the Elasticsearch JVM, what else can I do? Thanks in advance for your help! ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [November 5, 2025, 9:51am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119/5 "2025-11-05T09:51:32Z")
> [@flyxp11](#): > > If I can not attach it to the Elasticsearch JVM, what else can I do? Elasticsearch itself exposes an extensive collection of stats and metrics (e.g. via [Elastic Agent](https://www.elastic.co/elastic-agent)) so that’s what we’d recommend. General-purpose monitoring tools like Datadog’s agent don’t collect and interpret the Elasticsearch-specific metrics, making it impossible to properly interpret the metrics they do collect. ---
**Author:** ![flyxp11](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flyxp11/32/145584_2.png) [@flyxp11](https://discuss.elastic.co/u/flyxp11)\ **Post date:** [November 6, 2025, 11:53pm UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119/6 "2025-11-06T23:53:05Z")
Hello @**[DavidTurner](https://discuss.elastic.co/u/davidturner)**, Thank you for providing this important feedback regarding metric collection and the use of Elastic Agent. I fully understand and agree with your recommendation that Elastic Agent is the best solution for comprehensive metrics and operational monitoring of the Elasticsearch cluster itself. We will ensure we prioritize the use of native Elastic tools for that purpose. For clarification, our original goal with the Datadog Java Agent was not for general metrics collection, but specifically for Distributed Tracing (APM). This was to trace API calls from our application services through the Elasticsearch node to connect them within our wider APM environment. Update: We have received confirmation from Datadog that their Java Agent is not yet officially certified for use within the Elasticsearch 9.x Entitlements sandbox. Therefore, we have stopped our efforts to load the javaagent on the Elasticsearch nodes. We will proceed with the alternative solution of instrumenting the client applications only to ensure we capture the necessary trace correlation without interfering with Elasticsearch's internal security model. Thank you for clarifying the best practice for Elasticsearch monitoring. Best Regards, ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [November 9, 2025, 11:42am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119/7 "2025-11-09T11:42:23Z")
> [@flyxp11](#): > > For clarification, our original goal with the Datadog Java Agent was not for general metrics collection, but specifically for Distributed Tracing (APM). This was to trace API calls from our application services through the Elasticsearch node to connect them within our wider APM environment. Right but it’s the same issue here as with metrics: Elasticsearch uses its own very custom (and constantly-changing) framework for handling API calls so I wouldn’t expect a general-purpose APM agent like Datadog to yield any useful information. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 7, 2025, 11:42am UTC](https://discuss.elastic.co/t/how-to-configure-trust-entitlements-for-datadog-apm-java-agent-on-elasticsearch-9-x/383119/8 "2025-12-07T11:42:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.