- Fleet and Elastic Agent Guide: other versions:
- Fleet and Elastic Agent overview
- Beats and Elastic Agent capabilities
- Quick starts
- Migrate from Beats to Elastic Agent
- Deployment models
- Install Elastic Agents
- Install Fleet-managed Elastic Agents
- Install standalone Elastic Agents (advanced users)
- Install Elastic Agents in a containerized environment
- Run Elastic Agent in a container
- Run Elastic Agent on Kubernetes managed by Fleet
- Advanced Elastic Agent configuration managed by Fleet
- Run Elastic Agent on GKE managed by Fleet
- Run Elastic Agent on Amazon EKS managed by Fleet
- Run Elastic Agent on Azure AKS managed by Fleet
- Run Elastic Agent Standalone on Kubernetes
- Scaling Elastic Agent on Kubernetes
- Using a custom ingest pipeline with the Kubernetes Integration
- Environment variables
- Installation layout
- Air-gapped environments
- Using a proxy server with Elastic Agent and Fleet
- Uninstall Elastic Agents from edge hosts
- Start and stop Elastic Agents on edge hosts
- Elastic Agent configuration encryption
- Secure connections
- Manage Elastic Agents in Fleet
- Configure standalone Elastic Agents
- Create a standalone Elastic Agent policy
- Structure of a config file
- Inputs
- Providers
- Outputs
- SSL/TLS
- Logging
- Feature flags
- Agent download
- Config file examples
- Grant standalone Elastic Agents access to Elasticsearch
- Example: Use standalone Elastic Agent to monitor nginx
- Debug standalone Elastic Agents
- Kubernetes autodiscovery with Elastic Agent
- Monitoring
- Reference YAML
- Manage integrations
- Define processors
- Processor syntax
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_cef
- decode_csv_fields
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- parse_aws_vpc_flow_log
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Command reference
- Troubleshoot
- Release notes
Fleet and Elastic Agent 8.11.1
editFleet and Elastic Agent 8.11.1
editReview important information about Fleet Server and Elastic Agent for the 8.11.1 release.
Due to a memory leak issue, Windows users running Elastic Agent are recommended to avoid upgrading to this release and waiting for the upcoming 8.11.2 release in which the issue is resolved. If you’ve already upgraded to version 8.11.0 or 8.11.1, we recommend upgrading to 8.11.2 as soon as it becomes available. See the known issue for more detail.
Known issues
edit- The known issue that could prevent the Elastic Agent or Integrations Server component from booting up within an ECE deployment has been resolved in this release.
Memory leak running Elastic Agent in Windows environments with the System Integration
Details
A memory leak has been identified in Beats on Windows. All Beats running Elastic Stack version 8.11.0 or 8.11.1 are affected. The leak also affects the Elastic Agent System integration which is implemented with Beats. The leak will eventually exhaust all memory on the host system, typically after several days.
Impact
This issue has been fixed in version 8.11.2. For a Windows environment, we strongly recommend upgrading directly to 8.11.2 or any later release.
If you’re already running Elastic Agent version 8.11.0 or 8.11.1 on Windows and do not want to upgrade, we recommend that you:
-
Disable the
process
andprocess_summary
metrics in your System integration. - Disable logs and metrics collection.
- Restart Elastic Agent.
Note that disabling these datasets will prevent the collection of process-related metrics.
Another workaround is to downgrade Elastic Agent to a version below 8.11.0. Note that this could result in missing or reindexed logs or metrics as the "state" will not be persisted after Elastic Agent is uninstalled and reinstalled.
For Beats we currently do not have a workaround apart from upgrading to 8.12.2 or a later release.
Current stack version is not in the list of Elastic Agent versions in Kibana Fleet UI
Details
On the Fleet UI in Kibana:
- When adding a new Elastic Agent, the user interface shows a previous version instead of the current version.
- When attempting to upgrade, the modal window to pick the version shows an earlier version as the latest version.
Impact
You can use the following steps as a workaround:
When upgrading Elastic Agent currently on versions 8.10.4 or lower (simpler)
- Open the Fleet UI. Under the Agents tab select Upgrade agent from the actions menu. The version field in the Upgrade agent UI allows you to enter any version.
-
Enter
8.11.0
or whichever version you want to upgrade the [agents] to. Do not choose a version above the version of Kibana or Fleet Server that you’re running.
When upgrading Elastic Agent currently on any version (more complex, requires API)
- Open Kibana and navigate to Management → Dev Tools.
-
Choose one of the API requests below and submit it through the console. Each of the requests uses version
8.11.0
as an example, but this can be changed to any available version.-
To upgrade a single Elastic Agent to any version, run:
POST kbn:/api/fleet/agents/<Elastic Agent ID>/upgrade {"version":"8.11.0"}
-
To upgrade a set of Elastic Agents based on a known set of agent IDs, run:
POST kbn:/api/fleet/agents/bulk_upgrade { "version":"8.11.0", "agents":["<Elastic Agent ID>","<Another Elastic Agent ID>"], "start_time":"2023-11-10T09:41:39.850Z" }
-
To upgrade a set of Elastic Agents running a specific policy, and below a specific version (for example,
8.11.0
), run:POST kbn:/api/fleet/agents/bulk_upgrade { "agents": "fleet-agents.policy_id:<Elastic Fleet Policy ID> and fleet-agents.agent.version<<VERSION>", "version": "8.11.0" }
POST kbn:/api/fleet/agents/bulk_upgrade { "agents": "fleet-agents.policy_id:uuid1-uuid2-uuid3-uuid4 and fleet-agents.agent.version<8.11.0", "version": "8.11.0" }
-
To find the ID for any Elastic Agent, open the Agents tab in Fleet and select View agent from the Actions menu. The agent ID and other details are shown.
To learn more about these requests, refer to the Fleet API documentation.
New features
editThe 8.11.1 release Added the following new and notable features.
- Elastic Agent
Bug fixes
editOn this page