You can unenroll an agent to invalidate the API key used to connect to Elasticsearch.
- In Ingest Manager, select Fleet.
- Under Agents, choose Unenroll from the Actions menu next to the agent you want to unenroll.
The agent will continue to run, but will not be able to send data. It will show this error instead:
invalid api key to authenticate with fleet.
If unenrollment hangs, select Force unenroll to invalidate all API
keys related to the agent and change the status to
inactive so that the agent
no longer appears in Fleet.