Unenroll Elastic Agentedit

You can unenroll an agent to invalidate the API key used to connect to Elasticsearch.

  1. In Ingest Manager, select Fleet.
  2. Under Agents, choose Unenroll from the Actions menu next to the agent you want to unenroll.
  3. Click Unenroll.

    The agent will continue to run, but will not be able to send data. It will show this error instead: invalid api key to authenticate with fleet.

If unenrollment hangs, select Force unenroll to invalidate all API keys related to the agent and change the status to inactive so that the agent no longer appears in Fleet.