Fleet UI settingsedit

The settings described here are configurable through the Fleet UI. Refer to Fleet settings in Kibana for a list of settings that you can configure in the kibana.yml configuration file.

Configure Fleet settings to apply global settings to all Elastic Agents enrolled in Fleet:

  1. In Kibana, open the main menu, then click Management > Fleet > Settings.
  2. Under Fleet Server hosts, click Edit hosts and specify one or more host URLs:

    Fleet Server hosts

    The URLs your Elastic Agents will use to connect to a Fleet Server. This setting is required. On self-managed clusters, you must specify one or more URLs.

    Not sure if Fleet Server is running? Refer to Add a Fleet Server.

    On Elastic Cloud, this field is populated automatically. If you are using Azure Private Link, GCP Private Service Connect, or AWS PrivateLink and enrolling the Elastic Agent with a private link URL, ensure that this setting is configured. Otherwise, Elastic Agent will reset to use a default address instead of the private link URL.

    If a URL is specified without a port, Kibana sets the port to 80 (http) or 443 (https).

    By default, Fleet Server is typically exposed on the following ports:

    8220
    Default Fleet Server port for self-managed clusters
    443 or 9243
    Default Fleet Server port for Elastic Cloud. View the Fleet Settings tab to find the actual port that’s used.

    The exposed ports must be open for ingress and egress in the firewall and networking rules on the host to allow Elastic Agents to communicate with Fleet Server.

    Specify multiple URLs to scale out your deployment and provide automatic failover.

    If multiple URLs exist, Fleet shows the first provided URL for enrollment purposes. Enrolled Elastic Agents will connect to the URLs in round robin order until they connect successfully.

    When a Fleet Server is added or removed from the list, all agent policies are updated automatically.

    Examples:

    • https://192.0.2.1:8220
    • https://abae718c1276457893b1096929e0f557.fleet.eu-west-1.aws.qa.cld.elstc.co:443
    • https://[2001:db8::1]:8220
  3. Under Outputs, click the Edit icon in the Action column to modify output settings, as needed.

    The Elastic Cloud internal output is locked and cannot be edited. This output is used for internal routing to reduce external network charges when using the Elastic Cloud agent policy. It also provides visibility for troubleshooting on Elastic Cloud Enterprise.

    Name

    The name of the output.

    Type

    The output type. Elasticsearch is the only output type currently supported by Fleet-managed Elastic Agents.

    Hosts

    The Elasticsearch URLs where Elastic Agents will send data. By default, Elasticsearch is exposed on the following ports:

    9200
    Default Elasticsearch port for self-managed clusters
    443
    Default Elasticsearch port for Elastic Cloud

    Examples:

    • https://192.0.2.0:9200
    • https://1d7a52f5eb344de18ea04411fe09e564.fleet.eu-west-1.aws.qa.cld.elstc.co:443
    • https://[2001:db8::1]:9200

    Elasticsearch CA trusted fingerprint

    HEX encoded SHA-256 of a CA certificate. If this certificate is present in the chain during the handshake, it will be added to the certificate_authorities list and the handshake will continue normally. To learn more about trusted fingerprints, refer to the Elasticsearch security documentation.

    Advanced YAML configuration

    YAML settings that will be added to the Elasticsearch output section of each policy. This setting allows you to specify global output settings for all Elastic Agents enrolled in Fleet. Make sure you specify valid YAML. The UI does not currently provide validation.

  4. Save and apply the settings.