Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docset.yml
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
project: 'Elastic documentation'
max_toc_depth: 2

Expand Down Expand Up @@ -144,6 +144,9 @@
fleet-server: "Fleet Server"
integrations-server: "Integrations Server"
integrations: "Integrations"
managed-integration: "agentless integration"
managed-integrations: "agentless integrations"
managed-integrations-cap: "Agentless integrations"
package-registry: "Elastic Package Registry"
artifact-registry: "Elastic Artifact Registry"
aws: "AWS"
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
134 changes: 81 additions & 53 deletions manage-data/ingest/_snippets/agentless-integrations-faq.md
Original file line number Diff line number Diff line change
@@ -1,91 +1,119 @@
Frequently asked questions and troubleshooting steps for {{elastic-sec}}'s agentless integrations.
Frequently asked questions about {{managed-integrations}}. For step-by-step help with specific issues, see [Troubleshoot {{managed-integrations}}](/troubleshoot/ingest/agentless-integrations.md).

## When I make a new integration, when will I see the agent appear on the Integration Policies page? [_when_i_make_a_new_integration_when_will_i_see_the_agent_appear_on_the_integration_policies_page]
## About {{managed-integrations}} [agentless-faq-about]

After you create a new agentless integration, the new integration policy may show a button that says **Add agent** instead of the associated agent for several minutes during agent enrollment. No action is needed other than refreshing the page once enrollment is complete.
### What types of integrations are supported? [agentless-faq-supported]

## Why isn't my agentless agent appearing in Fleet?
```{applies_to}
stack: ga 9.1
serverless: ga
```
{{managed-integrations-cap}} are best suited for integrations that pull data from a cloud source through an API at moderate volumes. For a complete list, see [{{managed-integrations-cap}} quick reference](integration-docs://reference/agentless_integrations.md). Elastic continually adds more integrations to this list.

Agentless agents (which run on Elastic's infrastructure to enable agentless integrations) do not appear on the **Fleet** page by default. To view them on this page:
### Why aren't some integrations available as {{managed-integrations}}? [agentless-faq-missing]

Not every integration in Elastic's catalog fits the agentless deployment model. Only integrations that pull data from a cloud source through an API can be made available as {{managed-integrations}}. To request that an integration be made available, open an enhancement request in the [`elastic/integrations`](https://github.com/elastic/integrations) repository.

::::{applies-switch}
### How many {{managed-integrations}} can I deploy? [agentless-faq-limit]

:::{applies-item} { stack: ga 9.2, serverless: }
Go to the **Settings** tab of the **Fleet** page. Navigate to the **Advanced Settings** section, and enable **Show agentless resources**.
:::
You can deploy up to 50 {{managed-integrations}} per project. Adding multiple {{managed-integrations}} for the same source doesn't increase ingest throughput. For higher throughput, consider the [{{edot}} Cloud Forwarder](opentelemetry://reference/edot-cloud-forwarder/index.md).

:::{applies-item} stack: ga =9.1
Add the following query to the end of the **Fleet** page's URL: `?showAgentless=true`.
:::
### Can I create alerts on data ingested by {{managed-integrations}}? [agentless-faq-alerting]

::::
Yes. Data ingested through {{managed-integrations}} lands in your cluster like any other integration data, so all {{es}} and {{kib}} features apply — including [alerting](/explore-analyze/alerting.md).

## Pricing and SLAs [agentless-faq-pricing-slas]

## How do I troubleshoot an `Offline` agent? [_how_do_i_troubleshoot_an_offline_agent]
### How am I charged for {{managed-integrations}}? [agentless-faq-pricing]

For agentless integrations to successfully connect to {{elastic-sec}}, the {{fleet}} server host value must be the default. Otherwise, the agent status on the {{fleet}} page will be `Offline`, and logs will include the error `[elastic_agent][error] Cannot checkin in with fleet-server, retrying`.
On {{serverless-short}} projects, the cost of {{managed-integrations}} is included in your subscription. During technical preview, there are no additional costs on {{ech}} either. For current pricing details, see the [Elastic pricing page](https://www.elastic.co/pricing).

To troubleshoot this issue:
### What SLAs apply to {{managed-integrations}}? [agentless-faq-slas]

1. Find **{{fleet}}** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Go to the **Settings** tab.
2. Under **{{fleet}} server hosts**, click the **Actions** button for the policy named `Default`. This opens the Edit {{fleet}} Server flyout. The policy named `Default` should have the **Make this {{fleet}} server the default one** setting enabled. If not, enable it, then delete your integration and create it again.
On {{serverless-full}}, {{managed-integrations}} follow the [{{serverless-full}} SLA](https://www.elastic.co/agreements/sla-elastic-cloud-serverless). On {{ech}}, {{managed-integrations}} are in technical preview and aren't covered by the {{ech}} SLA.

If the **Make this {{fleet}} server the default one** setting was already enabled but problems persist, it’s possible someone changed the default {{fleet}} server’s **URL** value. In this case, contact Elastic Support to find out what the original **URL** value was, update the settings to match this value, then delete your integration and create it again.
## Data and security [agentless-faq-data-security]

::::{note}
:applies_to: ess: ga
In {{ech}} deployments on {{stack}} versions prior to 9.1.6, the connection between agentless integrations and {{fleet-server}} can break if the default {{fleet-server}} host URL value in {{fleet}} is modified or if a different host URL is set as the default.
### Where is my data stored? [agentless-faq-data-storage]

Check notice on line 33 in manage-data/ingest/_snippets/agentless-integrations-faq.md

View workflow job for this annotation

GitHub Actions / build / vale

Elastic.FirstPerson: Use caution when using first-person pronouns such as 'my.'

This issue is resolved in {{stack}} 9.1.6. In this and later versions, agentless integration policies are assigned to a default managed {{fleet-server}} host which cannot be modified.
::::
Documents ingested through {{managed-integrations}} are stored in your project or {{ech}} deployment, the same as data ingested by agent-based integrations.

### Who at Elastic has access to my data? [agentless-faq-data-access]

Check notice on line 37 in manage-data/ingest/_snippets/agentless-integrations-faq.md

View workflow job for this annotation

GitHub Actions / build / vale

Elastic.FirstPerson: Use caution when using first-person pronouns such as 'my.'

## Why can't I upgrade my agentless integration to a newer version?
Elastic employees don't have access to data in your project or deployment. Data ingested through {{managed-integrations}} is stored in your cluster, with the same access controls as data ingested by any other method.

On versions of {{stack}} before v9.2, agentless integrations can't be upgraded to newer versions of the integration. To get a newer version in your {{stack}} environment, upgrade to {{stack}} v9.2+ or delete and re-install the desired integration.
### Can {{managed-integrations}} use a specific range of static IP addresses? [agentless-faq-static-ip]

No. {{managed-integrations}} run on shared infrastructure and don't use a fixed range of IP addresses for ingress or egress.

## How do I troubleshoot an `Unhealthy` agent? [_how_do_i_troubleshoot_an_unhealthy_agent]
### Do {{managed-integrations}} work with traffic filtering? [agentless-faq-traffic-filtering]

On the **{{fleet}}** page, agents associated with agentless integrations have names that begin with `agentless`. To troubleshoot an `Unhealthy` agent:
```{applies_to}
stack: preview 9.1
serverless: preview
```

1. Go to the **Settings** tab of the **Fleet** page. Go to the **Advanced Settings** section, and turn on the **Show agentless resources** toggle.
2. In {{fleet}}, select the unhealthy agent.
3. From the **Actions** menu, select **Request diagnostics .zip**.
4. Download and unzip the [diagnostics bundle](/troubleshoot/ingest/fleet/diagnostics.md). Refer to [Common problems with {{fleet}} and {{agent}}](/troubleshoot/ingest/fleet/common-problems.md) for more information.
Yes. {{managed-integrations-cap}} support traffic filtering, and no additional configuration is necessary.

## How do I delete an agentless integration? [_how_do_i_delete_an_agentless_integration]
## Limits and behavior [agentless-faq-limits]

::::{note}
Deleting your integration will remove all associated resources and stop data ingestion.
::::
### Is there a maximum throughput? [agentless-faq-throughput]

Yes. To preserve quality of service across all {{managed-integrations}}, throughput is rate-limited on {{serverless-short}} for integrations whose underlying input type is `httpjson` or `cel` (two common pull-based input mechanisms in {{agent}}). Rate limiting uses back-pressure rather than dropping events, so collection slows down until the source catches up.

When you create a new agentless integration, a new agent policy appears within the **Agent policies** tab on the **{{fleet}}** page, but you can’t use the **Delete integration** button on this page. Instead, you must delete the integration from the Integration’s **Integration policies** tab.
### Does the service scale horizontally? [agentless-faq-horizontal-scaling]

1. Find **Integrations** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then search for your integration.
2. Go to the integration’s **Integration policies** tab.
3. Find the integration policy for the integration you want to delete. Click **Actions**, then **Delete integration**.
4. Confirm by clicking **Delete integration** again.
No. Deploying multiple {{managed-integrations}} for the same source doesn't increase ingest throughput. For higher throughput, consider the [{{edot}} Cloud Forwarder](opentelemetry://reference/edot-cloud-forwarder/index.md).

## Can agentless integrations use a specific range of static IP addresses for configuring allow and deny rules for traffic?
### What happens to my data if there's a service issue? [agentless-faq-disaster]

Check notice on line 64 in manage-data/ingest/_snippets/agentless-integrations-faq.md

View workflow job for this annotation

GitHub Actions / build / vale

Elastic.FirstPerson: Use caution when using first-person pronouns such as 'my.'

No, agentless integrations can not use a specific range of static IP addresses for configuring ingress and egress allow and deny rules.
For an isolated issue with a single agent, Elastic restarts the agent and ingestion resumes. Any events in the agent's in-memory queue might be lost. For a service-wide outage, no data is collected until the infrastructure recovers, and some in-flight events might be lost.

## Do agentless integrations work if I'm using traffic filtering?
## Setup and operation [agentless-faq-operations]

### Why does my integration policy show "Add agent" instead of an agent? [agentless-faq-add-agent-button]

Check notice on line 70 in manage-data/ingest/_snippets/agentless-integrations-faq.md

View workflow job for this annotation

GitHub Actions / build / vale

Elastic.FirstPerson: Use caution when using first-person pronouns such as 'my.'

After you create a new {{managed-integration}}, the integration policy might show an **Add agent** button for several minutes while Elastic provisions the {{agent}}. The button disappears automatically once provisioning is complete. Refresh the page if you want to see the updated status sooner — no other action is needed.

### Why aren't {{managed-integration}} agents listed in {{fleet}}? [agentless-faq-fleet-visibility]

```{applies_to}
stack: preview 9.1-9.4
serverless: unavailable
```

{{managed-integrations-cap}} are a fully managed service, so the underlying {{agents}} aren't shown in **{{fleet}}** by default. You usually don't need to monitor their health — Elastic operates the infrastructure on your behalf.

To make them visible in **{{fleet}}** anyway:

::::{applies-switch}

:::{applies-item} serverless: ga
Agentless integrations do not support traffic filtering.
:::{applies-item} { stack: ga 9.2-9.4 }
Go to the **Settings** tab of the **{{fleet}}** page. In the **Advanced Settings** section, enable **Show agentless resources**.
:::

:::{applies-item} stack: ga 9.1+
Agentless integrations support traffic filtering. No additional configuration is necessary.
:::{applies-item} stack: ga =9.1
Add the query parameter `?showAgentless=true` to the end of the **{{fleet}}** page's URL.
:::

::::
::::

### How do I troubleshoot an Offline or Unhealthy agent? [agentless-faq-troubleshoot]

{{managed-integrations-cap}} are a fully managed service, so you usually don't need to collect diagnostics yourself. For step-by-step guidance — including how to get support and (if needed) collect a diagnostics bundle — see [Troubleshoot {{managed-integrations}}](/troubleshoot/ingest/agentless-integrations.md).

### Why can't I upgrade my {{managed-integration}} to a later version? [agentless-faq-upgrade]

```{applies_to}
stack: preview 9.0-9.1
```

On {{stack}} versions before 9.2, {{managed-integrations}} can't be upgraded to later versions of the integration. To get a later version, upgrade to {{stack}} 9.2 or later, or delete and re-install the integration.

### How do I delete an {{managed-integration}}? [agentless-faq-delete]

::::{note}
Deleting an {{managed-integration}} removes all associated resources and stops data ingestion.
::::


1. In {{kib}}, find **{{integrations}}** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md), then search for your integration.
2. Go to the integration's **Integration policies** tab.
3. Find the integration policy to delete. Click the actions icon {icon}`ellipsis`, then select **Delete integration**.
4. Confirm by clicking **Delete integration** again.
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
Resolve common issues with {{managed-integrations}}. For more general questions, see the [{{managed-integrations-cap}} FAQ](/manage-data/ingest/agentless/agentless-integrations-faq.md).

## Get diagnostics and support [agentless-troubleshoot-support]

{{managed-integrations-cap}} are a fully managed service, so you usually don't need to collect diagnostics yourself. If you suspect a problem with the service or your deployment, contact [Elastic Support](https://support.elastic.co) — they'll collect diagnostics on your behalf and investigate.

## Troubleshoot an Offline agent [agentless-troubleshoot-offline]

```{applies_to}
ech: preview
```

For {{managed-integrations}} to connect to your cluster, the {{fleet-server}} host value must be the default. Otherwise, the agent shows as `Offline` on the **{{fleet}}** page, and logs include the error `[elastic_agent][error] Cannot checkin in with fleet-server, retrying`.

To troubleshoot:

1. Find **{{fleet}}** in the navigation menu or use the [global search field](/explore-analyze/find-and-organize/find-apps-and-objects.md). Go to the **Settings** tab.
2. Under **Fleet server hosts**, click the **Edit** icon {icon}`pencil` for the host named `Default`. This opens the **Edit Fleet Server** flyout. The host named `Default` must have the **Make this Fleet Server the default one** setting enabled. If not, enable it, then delete and re-create your integration.

If the setting was already enabled but problems persist, the default {{fleet-server}} URL might have been changed. Contact [Elastic Support](https://support.elastic.co) to recover the original URL.

::::{note}
On {{ech}} deployments with {{stack}} versions before 9.1.6, the connection between {{managed-integrations}} and {{fleet-server}} can break if the default {{fleet-server}} host URL is modified or if a different host URL is set as the default.

This issue is resolved in {{stack}} 9.1.6 and later. In those versions, {{managed-integration}} policies are assigned to a default managed {{fleet-server}} host that can't be modified.
::::

## Troubleshoot an Unhealthy agent [agentless-troubleshoot-unhealthy]

On the **Fleet** → **Agents** page, agents associated with {{managed-integrations}} have names that begin with `agentless`. When an agentless agent is `Unhealthy`:

1. **Check the integration configuration.** Most `Unhealthy` states are caused by expired or invalid credentials, or by source-side permission issues. Confirm that the credentials and configuration you provided for the integration are still valid.
2. **Contact [Elastic Support](https://support.elastic.co).** If the configuration looks correct but the agent remains unhealthy, support will collect diagnostics and investigate on your behalf.

:::{dropdown} Collect diagnostics yourself
:applies_to: stack: preview 9.1-9.4

If you want to collect a diagnostics bundle before contacting support:

1. Make agentless agents visible in **{{fleet}}**:

::::{applies-switch}

:::{applies-item} stack: preview 9.2-9.4
Go to the **Settings** tab of the **{{fleet}}** page. In the **Advanced Settings** section, enable **Show agentless resources**.
:::

:::{applies-item} stack: preview =9.1
Add the query parameter `?showAgentless=true` to the end of the **{{fleet}}** page's URL.
:::

::::

2. In **{{fleet}}**, select the unhealthy agent.
3. From the actions menu {icon}`ellipsis`, select **Maintenance and diagnostics** → **Request diagnostics .zip**.
4. Download and unzip the [diagnostics bundle](/troubleshoot/ingest/fleet/diagnostics.md). For more information, see [Common problems with {{fleet}} and {{agent}}](/troubleshoot/ingest/fleet/common-problems.md).
:::
21 changes: 11 additions & 10 deletions manage-data/ingest/agentless/agentless-integrations-faq.md
Original file line number Diff line number Diff line change
@@ -1,18 +1,19 @@
---
mapped_pages:
- https://www.elastic.co/guide/en/security/current/agentless-integrations.html
- https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html
applies_to:
stack: all
serverless:
security: all
stack: preview
serverless: preview
products:
- id: security
- id: elastic-agent
- id: fleet
- id: cloud-serverless
navigation_title: Agentless integrations FAQs
- id: cloud-hosted
- id: observability
- id: security
description: Frequently asked questions and troubleshooting steps for agentless integrations, including limits, supportability, and common setup issues.
navigation_title: FAQ
---

# {{elastic-sec}} agentless integrations FAQs [agentless-integration-troubleshooting]
# {{managed-integrations-cap}} FAQ [agentless-integration-faq]

:::{include} ../_snippets/agentless-integrations-faq.md
:::
:::
Loading
Loading