IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Fleet and Elastic Agent 8.17.1 Appendix A: Install a Fleet-managed Elastic Agent »
Elastic Docs ›Fleet and Elastic Agent Guide [8.17] ›Release notes

Fleet and Elastic Agent 8.17.0

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Fleet and Elastic Agent 8.17.0

edit

Review important information about the Fleet and Elastic Agent 8.17.0 release.

Breaking changes

edit

Breaking changes can prevent your application from optimal operation and performance. Before you upgrade, review the breaking changes, then mitigate the impact to your application.

Elastic Agent
  • Elastic Agent is now compiled using Debian 11 and linked against glibc 2.31 instead of 2.19. Drops support for Debian 10. #5847

Known Issues

edit
An Elastic Agent with the Defend integration may report an Orphaned status and will not be able to be issued an upgrade action through Fleet.

Details
A known issue in the Elastic Agent may prevent it from being targeted with an upgrade action for a future release. This may occur if the Defend integration is used and the agent is stopped on a running instance for too long. An agent may be stopped as part of an upgrade process.

Impact
A bug fix is present in the 8.17.1 release of Fleet that will prevent this from occurring.

If you have agents that are affected, the workaround is as follows:

# Get a Token to issue an update_by_query request:
curl -XPOST --user elastic:${SUPERUSER_PASS} -H 'x-elastic-product-origin:fleet' -H'content-type:application/json' "https://${ELASTICSEARCH_HOST}/_security/service/elastic/fleet-server/credential/token/fix-unenrolled"

# Issue an update_by_query request that targets effected agents:
curl -XPOST -H 'Authorization: Bearer ${TOKEN}' -H 'x-elastic-product-origin:fleet' -H 'content-type:application/json' "https://${ELASTICSEARCH_HOST}/.fleet-agents/_update_by_query" -d '{"query": {"bool": {"must": [{ "exists": { "field": "unenrolled_at" } }],"must_not": [{ "term": { "active": "false" } }]}},"script": {"source": "ctx._source.unenrolled_at = null;","lang": "painless"}}'
fleet-agents template is missing mappings

Details

On May 2, 2025 a known issue was discovered that the .fleet-agents index template was missing a mapping for the local_metadata.complete attribute. This may cause agent checkins to be rejected and the agents to appear as offline.

In this Fleet’s logs this will appear as:

elastic fail 400: document_parsing_exception: [1:209] object mapping for [local_metadata] tried to parse field [local_metadata] as object, but found a concrete value
Eat bulk checkin error; Keep on truckin'

And in the Elastic Agent logs it will appear as:

"log.level":"error","@timestamp":"2025-04-22:12:35:25.295Z","message":"Eat bulk checkin error; Keep on truckin'","component":{"binary":"fleet-server","dataset":"elastic_agent.fleet_server","id":"fleet-server-es-containerhost","type":"fleet-server"},"log":{"source":"fleet-server-es-containerhost"},"service.type":"fleet-server","error.message":"elastic fail 400: document_parsing_exception: [1:209] object mapping for [local_metadata] tried to parse field [local_metadata] as object, but found a concrete value","ecs.version":"1.6.0","service.name":"fleet-server","ecs.version":"1.6.0"

This attribute was added to the template in versions: 8.17.11 8.18.3, and 8.19.3.

Further investigation revealed that the .fleet-agents index template was not correctly applied due to an unchanged _meta.managed_index_mappings_version number. This change also affects other attributes as well, such as upgrade_attempts, namespaces, unprivileged, and unhealthy_reason. If there is an error related to any of these attributes, there will be a similar error message in the logs.

Impact

Updating to a version with a fixed _meta.managed_index_mappings_version will correctly apply the new index template. The fixed versions are 8.18.8, 8.19.4, 9.0.8, 9.1.4.

New features

edit

The 8.17.0 release Added the following new and notable features.

Fleet
  • Expose advanced file logging configuration in the UI. #200274
Elastic Agent
  • Add support for running as a pre-existing user when installing in unprivileged mode, with technical preview support for pre-existing Windows Active Directory users. #5988 #4585
  • Add a new custom Filestream logs integration. This will enable migration from the custom log integration which is based on a log input that is planned for deprecation. #11332.

Enhancements

edit
Fleet
  • Filter the integrations/packages list shown in the UI depending on the policy_templates_behavior field. #200605
  • Add a <type>@custom component template to integrations index template’s composed_of array. #192731
Fleet Server
  • Update elastic-agent-libs to version 0.14.0. #4042
Elastic Agent
  • Enable persistence in the configuration provided with our OTel Collector distribution. #5549
  • Restrict using the CLI to upgrade for Fleet-managed Elastic Agents. #5864 #4890
  • Add os_family, os_platform and os_version to the Elastic Agent host provider, enabling differentiating Linux distributions. This is required to support Debian 12 and other distributions that are moving away from traditional log files in favour of Journald. #5941 10797 11618
  • Emit Pod data only for Pods that are running in the Kubernetes provider. #6011 #5835 #5991
  • Remove Endpoint Security from Linux container images. Endpoint Security cannot run in containers since it has a systemd dependency. #6016 #5495
  • Update OTel components to v0.114.0. #6113
  • Redact common secrets like API keys and passwords in the output from elastic-agent inspect command. #6224

Bug fixes

edit
Fleet
  • Allow creation of an integration policy with no agent policies. #201051
Fleet Server
  • Fix server.address field which was appearing empty in HTTP request logs. #4142
  • Remove a race condition that may occur when remote ES outputs are used. #4171 #4170
Elastic Agent
  • Make redaction of common keys in diagnostics case insensitive. #6109
« Fleet and Elastic Agent 8.17.1 Appendix A: Install a Fleet-managed Elastic Agent »