Is it possible to remove unenrolled Agents from Fleet?

Elastic Stack Kibana
1

Hi,

I did see the following question: Is it possible to remove Inactive Agents from Fleet?

And actually there is an undocumented (and potentially dangerous) way to remove unenrolled agents. Because I couldn't add my answer there (the thread is closed) I created a new post for people looking for a solution.

2
  1. Create a service token
POST /_security/service/elastic/fleet-server/credential/token/delete-agents

  1. Search the .fleet-agents index for the entry you want to delete and get the document _id.

  2. Delete the fleet entry document (set/replace the ES_URL, DOC_ID, and SERVICE_TOKEN, with the elasticsearch url, the document id to delete, and the in the first step created service token):

curl --request DELETE \
  --url ${ES_URL}/.fleet-agents-7/_doc/${DOC_ID} \
  --header 'Authorization: Bearer ${SERVICE_TOKEN}' \
  --header 'Content-Type: application/json' \
  --header 'kbn-xsrf: kibana' \
  --header 'x-elastic-product-origin: fleet'
  1. Delete the service token
DELETE /_security/service/elastic/fleet-server/credential/token/delete-agents

This answer can be merged into the other thread by admins if they want to. Because unfortunately it is no longer possible to answer there. However, I wanted to document my solution for others to find.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.