- Fleet and Elastic Agent Guide: other versions:
- Fleet and Elastic Agent overview
- Beats and Elastic Agent capabilities
- Quick starts
- Migrate from Beats to Elastic Agent
- Deployment models
- Install Elastic Agents
- Install Fleet-managed Elastic Agents
- Install standalone Elastic Agents
- Install Elastic Agents in a containerized environment
- Run Elastic Agent in a container
- Run Elastic Agent on Kubernetes managed by Fleet
- Install Elastic Agent on Kubernetes using Helm
- Example: Install standalone Elastic Agent on Kubernetes using Helm
- Example: Install Fleet-managed Elastic Agent on Kubernetes using Helm
- Advanced Elastic Agent configuration managed by Fleet
- Configuring Kubernetes metadata enrichment on Elastic Agent
- Run Elastic Agent on GKE managed by Fleet
- Run Elastic Agent on Amazon EKS managed by Fleet
- Run Elastic Agent on Azure AKS managed by Fleet
- Run Elastic Agent Standalone on Kubernetes
- Scaling Elastic Agent on Kubernetes
- Using a custom ingest pipeline with the Kubernetes Integration
- Environment variables
- Run Elastic Agent as an OTel Collector
- Run Elastic Agent without administrative privileges
- Install Elastic Agent from an MSI package
- Installation layout
- Air-gapped environments
- Using a proxy server with Elastic Agent and Fleet
- Uninstall Elastic Agents from edge hosts
- Start and stop Elastic Agents on edge hosts
- Elastic Agent configuration encryption
- Secure connections
- Manage Elastic Agents in Fleet
- Configure standalone Elastic Agents
- Create a standalone Elastic Agent policy
- Structure of a config file
- Inputs
- Providers
- Outputs
- SSL/TLS
- Logging
- Feature flags
- Agent download
- Config file examples
- Grant standalone Elastic Agents access to Elasticsearch
- Example: Use standalone Elastic Agent with Elastic Cloud Serverless to monitor nginx
- Example: Use standalone Elastic Agent with Elasticsearch Service to monitor nginx
- Debug standalone Elastic Agents
- Kubernetes autodiscovery with Elastic Agent
- Monitoring
- Reference YAML
- Manage integrations
- Package signatures
- Add an integration to an Elastic Agent policy
- View integration policies
- Edit or delete an integration policy
- Install and uninstall integration assets
- View integration assets
- Set integration-level outputs
- Upgrade an integration
- Managed integrations content
- Best practices for integration assets
- Data streams
- Define processors
- Processor syntax
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_cef
- decode_csv_fields
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- parse_aws_vpc_flow_log
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Command reference
- Troubleshoot
- Release notes
Fleet settings
editFleet settings
editThe settings described here are configurable through the Fleet UI. Refer to
Fleet settings in Kibana for a list of
settings that you can configure in the kibana.yml
configuration file.
On the Settings tab in Fleet, you can configure global settings available to all Elastic Agents enrolled in Fleet. This includes Fleet Server hosts and output settings.
Fleet Server host settings
editClick Edit hosts and specify the host URLs your Elastic Agents will use to connect to a Fleet Server.
If the Edit hosts option is grayed out, Fleet Server hosts are configured outside of Fleet. For more information, refer to Fleet settings in Kibana.
Not sure if Fleet Server is running? Refer to What is Fleet Server?.
On self-managed clusters, you must specify one or more URLs.
On Elastic Cloud, this field is populated automatically. If you are using Azure Private Link, GCP Private Service Connect, or AWS PrivateLink and enrolling the Elastic Agent with a private link URL, ensure that this setting is configured. Otherwise, Elastic Agent will reset to use a default address instead of the private link URL.
If a URL is specified without a port, Kibana sets the port to 80
(http)
or 443
(https).
By default, Fleet Server is typically exposed on the following ports:
-
8220
- Default Fleet Server port for self-managed clusters
-
443
or9243
- Default Fleet Server port for Elastic Cloud. View the Fleet Settings tab to find the actual port that’s used.
The exposed ports must be open for ingress and egress in the firewall and networking rules on the host to allow Elastic Agents to communicate with Fleet Server.
Specify multiple URLs (click Add row) to scale out your deployment and provide automatic failover. If multiple URLs exist, Fleet shows the first provided URL for enrollment purposes. Enrolled Elastic Agents will connect to the URLs in round robin order until they connect successfully.
When a Fleet Server is added or removed from the list, all agent policies are updated automatically.
Examples:
-
https://192.0.2.1:8220
-
https://abae718c1276457893b1096929e0f557.fleet.eu-west-1.aws.qa.cld.elstc.co:443
-
https://[2001:db8::1]:8220
Output settings
editAdd or edit output settings to specify where Elastic Agents send data. Elastic Agents use the default output if you don’t select an output in the agent policy.
If you have an Enterprise
Elastic Stack subscription,
you can configure Elastic Agent to
send data to different outputs for different integration policies.
The Elastic Cloud internal output is locked and cannot be edited. This output is used for internal routing to reduce external network charges when using the Elastic Cloud agent policy. It also provides visibility for troubleshooting on Elastic Cloud Enterprise.
To add or edit an output:
- Go to Fleet → Settings.
-
Under Outputs, click Add output or Edit.
The Add new output UI opens.
- Set the output name and type.
-
Specify settings for the output type you selected:
- Click Save and apply settings.
If the options for editing an output are grayed out, outputs are configured outside of Fleet. For more information, refer to Fleet settings in Kibana.
Agent binary download settings
editElastic Agents must be able to access the Elastic Artifact Registry to download
binaries during upgrades. By default Elastic Agents download artifacts from the
artifact registry at https://artifacts.elastic.co/downloads/
.
For Elastic Agents that cannot access the internet, you can specify agent binary download settings, and then configure agents to download their artifacts from the alternate location. For more information about running Elastic Agents in a restricted environment, refer to Air-gapped environments.
To add or edit the source of binary downloads:
- Go to Fleet → Settings.
- Under Agent Binary Download, click Add agent binary source or Edit.
- Set the agent binary source name.
- For Host, specify the address where you are hosting the artifacts repository.
- (Optional) To make this location the default, select Make this host the default for all agent policies. Elastic Agents use the default location if you don’t select a different agent binary source in the agent policy.
Proxies
editYou can specify a proxy server to be used in Fleet Server, Elastic Agent outputs, or for any agent binary download sources. For full details about proxy configuration refer to Using a proxy server with Elastic Agent and Fleet.
Delete unenrolled agents
editAfter an Elastic Agent has been unenrolled in Fleet, a number of documents about the agent are retained just in case the agent needs to be recovered at some point. You can choose to have all data related to an unenrolled agent deleted automatically.
Note that this option can also be enabled by adding the xpack.fleet.enableDeleteUnenrolledAgents: true
setting to the Kibana settings file.
To enable automatic deletion of unenrolled agents:
- Go to Fleet → Settings.
- Under Advanced Settings, enable the Delete unenrolled agents option.
On this page