Fleet and Elastic Agent 8.17.0

Review important information about the Fleet and Elastic Agent 8.17.0 release.

Breaking changes

Breaking changes can prevent your application from optimal operation and performance. Before you upgrade, review the breaking changes, then mitigate the impact to your application.

Elastic Agent

Elastic Agent is now compiled using Debian 11 and linked against glibc 2.31 instead of 2.19. Drops support for Debian 10. #5847

Known Issues

edit

An Elastic Agent with the Defend integration may report an Orphaned status and will not be able to be issued an upgrade action through Fleet.

Details
A known issue in the Elastic Agent may prevent it from being targetted with an upgrade action for a future release. This may occur if the Defend integration is used and the agent is stopped on a running instance for too long. An agent may be stopped as part of an upgrade process.

Impact
A bug fix is present in the 8.17.1 release of Fleet that will prevent this from occuring.

If you have agents that are affected, the workaround is as follows:

# Get a Token to issue an update_by_query request:
curl -XPOST --user elastic:${SUPERUSER_PASS} -H 'x-elastic-product-origin:fleet' -H'content-type:application/json' "https://${ELASTICSEARCH_HOST}/_security/service/elastic/fleet-server/credential/token/fix-unenrolled"

# Issue an update_by_query request that targets effected agents:
curl -XPOST -H 'Authorization: Bearer ${TOKEN}' -H 'x-elastic-product-origin:fleet' -H 'content-type:application/json' "https://${ELASTICSEARCH_HOST}/.fleet-agents/_update_by_query" -d '{"query": {"bool": {"must": [{ "exists": { "field": "unenrolled_at" } }],"must_not": [{ "term": { "active": "false" } }]}},"script": {"source": "ctx._source.unenrolled_at = null;","lang": "painless"}}'

New features

edit

The 8.17.0 release Added the following new and notable features.

Fleet

Expose advanced file logging configuration in the UI. #200274

Elastic Agent

Add support for running as a pre-existing user when installing in unprivileged mode, with technical preview support for pre-existing Windows Active Directory users. #5988 #4585
Add a new custom Filestream logs integration. This will enable migration from the custom log integration which is based on a log input that is planned for deprecation. #11332.

Enhancements

edit

Fleet

Filter the integrations/packages list shown in the UI depending on the policy_templates_behavior field. #200605
Add a <type>@custom component template to integrations index template’s composed_of array. #192731

Fleet Server

Update elastic-agent-libs to version 0.14.0. #4042

Elastic Agent

Enable persistence in the configuration provided with our OTel Collector distribution. #5549
Restrict using the CLI to upgrade for Fleet-managed Elastic Agents. #5864 #4890
Add os_family, os_platform and os_version to the Elastic Agent host provider, enabling differentiating Linux distributions. This is required to support Debian 12 and other distributions that are moving away from traditional log files in favour of Journald. #5941 10797 11618
Emit Pod data only for Pods that are running in the Kubernetes provider. #6011 #5835 #5991
Remove Endpoint Security from Linux container images. Endpoint Security cannot run in containers since it has a systemd dependency. #6016 #5495
Update OTel components to v0.114.0. #6113
Redact common secrets like API keys and passwords in the output from elastic-agent inspect command. #6224

Bug fixes

edit

Fleet

Allow creation of an integration policy with no agent policies. #201051

Fleet Server

Fix server.address field which was appearing empty in HTTP request logs. #4142
Remove a race condition that may occur when remote ES outputs are used. #4171 #4170

Elastic Agent

Make redaction of common keys in diagnostics case insensitive. #6109

« Release notes Appendix A: Install a Fleet-managed Elastic Agent »