You can unenroll an agent to invalidate the API key used to connect to Elasticsearch.
- In Fleet, select Agents.
- Under Agents, choose Unenroll agent from the Actions menu next to the agent you want to unenroll.
Click Unenroll agent.
The agent will continue to run, but will not be able to send data. It will show this error instead:
invalid api key to authenticate with fleet.
If unenrollment hangs, select Force unenroll to invalidate all API
keys related to the agent and change the status to
inactive so that the agent
no longer appears in Fleet.