---
title: Fleet settings in Kibana
description: 
url: https://www.elastic.co/elastic/docs-builder/docs/3175/reference/kibana/configuration-reference/fleet-settings
products:
  - Kibana
applies_to:
  - Elastic Cloud Hosted: Generally available
  - Self-managed Elastic deployments: Generally available
---

# Fleet settings in Kibana
By default, Fleet is enabled. To use Fleet, you also need to configure Kibana and Elasticsearch hosts.
Many Fleet settings can also be configured directly through the Fleet UI. See [Fleet UI settings](https://www.elastic.co/docs/reference/fleet/fleet-settings) for details.
Go to the [Fleet](https://www.elastic.co/docs/reference/fleet/index) docs for more information about Fleet.

<note>
  In Elastic Cloud, Fleet flags are already configured.
</note>


## General Fleet settings
<definitions>
  <definition term="xpack.fleet.agents.enabled">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set to `true` (default) to enable Fleet.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="xpack.fleet.isAirGapped">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Set to `true` to indicate Fleet is running in an air-gapped environment. Refer to [Air-gapped environments](https://www.elastic.co/docs/reference/fleet/air-gapped) for details. Enabling this flag helps Fleet skip needless requests and improve the user experience for air-gapped environments.
Datatype: `bool`
Default: `false`
  </definition>
  <definition term="xpack.fleet.createArtifactsBulkBatchSize">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Allow to configure batch size for creating and updating Fleet user artifacts.  Examples include creation of Trusted Applications and Endpoint Exceptions in Security. It is available in Elastic Cloud 8.9.0 and later versions.
Datatype: `int`
  </definition>
</definitions>

## Elastic Package Manager settings
<definitions>
  <definition term="xpack.fleet.registryUrl">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

The address to use to reach the Elastic Package Manager registry.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.registryProxyUrl">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

The proxy address to use to reach the Elastic Package Manager registry if an internet connection is not directly available. Refer to [Air-gapped environments](https://www.elastic.co/docs/reference/fleet/air-gapped) for details.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.packageVerification.gpgKeyPath">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

The path on disk to the GPG key used to verify Elastic Package Manager packages. If the Elastic public key is ever reissued as a security precaution, you can use this setting to specify the new key.
Datatype: `string`
  </definition>
</definitions>

## Fleet settings

<note>
  The `xpack.fleet.agents.elasticsearch.*` settings are intended for a quickstart setup. For more advanced use cases, use the `xpack.fleet.outputs` setting to preconfigure outputs.
</note>

<definitions>
  <definition term="xpack.fleet.agents.fleet_server.hosts">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Hostnames used by Elastic Agent for accessing Fleet Server.
If configured in your `kibana.yml`, this setting is grayed out and unavailable in the Fleet UI. To make this setting editable in the UI, do not configure it in the configuration file.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agents.elasticsearch.hosts">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Hostnames used by Elastic Agent for accessing Elasticsearch.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agents.elasticsearch.ca_sha256">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Hash pin used for certificate verification. The pin is a base64-encoded string of the SHA-256 fingerprint.
Datatype: `string`
  </definition>
</definitions>

## Preconfiguration settings (for advanced use cases)

Use these settings to pre-define integrations, agent policies, and Fleet Server hosts or proxies that you want Fleet to load up by default.

<note>
  These settings are not supported to pre-configure the Endpoint and Cloud Security integration.
</note>

<definitions>
  <definition term="xpack.fleet.packages">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

List of integrations that are installed when the Fleet app starts up for the first time.
Datatype: `string`

```yaml
xpack.fleet.packages:
  - name: apache
    version: 0.5.0

xpack.fleet.agentPolicies:
  - name: Preconfigured Policy
    id: preconfigured-policy
    namespace: test
    package_policies:
      - package:
          name: system
        name: System Integration
        namespace: test
        id: preconfigured-system
        inputs:
          system-system/metrics:
            enabled: true
            vars:
              '[system.hostfs]': home/test
            streams:
              '[system.core]':
                enabled: true
                vars:
                  period: 20s
          system-winlog:
            enabled: false
```

  </definition>
  <definition term="xpack.fleet.packages[n].name">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Name of the integration from the package registry.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.packages[n].version">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Either an exact semantic version, or the keyword `latest` to fetch the latest integration version.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

List of agent policies that are configured when the Fleet app starts.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Unique ID for this policy. The ID may be a number or string.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].name">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Name of the agent policy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].description">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Text description of this policy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].namespace">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. String identifying this policy's namespace.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].monitoring_enabled">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. List of keywords that specify the monitoring data to collect. Valid values include `['logs']`, `['metrics']`, and `['logs', 'metrics']`.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].keep_monitoring_alive">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. If `true`, monitoring will be enabled, but logs/metrics collection will be disabled. Use this if you want to keep agent's monitoring server alive even when logs/metrics aren't being collected.
Datatype: `bool`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].is_managed">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. If `true`, this policy is not editable by the user and can only be changed by updating the Kibana config.
Datatype: `bool`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].is_default">
    <stack-availability>Elastic Stack: Deprecated since 8.1</stack-availability>
    <supported-on>Self-managed Elastic deployments: Deprecated since 8.1</supported-on>

Optional. If `true`, this policy is the default agent policy.
Datatype: `bool`

<admonition title="Deprecation details">
  Deprecated in 8.1.0.
</admonition>

  </definition>
  <definition term="xpack.fleet.agentPolicies[n].is_default_fleet_server">
    <stack-availability>Elastic Stack: Deprecated since 8.1</stack-availability>
    <supported-on>Self-managed Elastic deployments: Deprecated since 8.1</supported-on>

Optional. If `true`, this policy is the default Fleet Server agent policy.
Datatype: `bool`

<admonition title="Deprecation details">
  Deprecated in 8.1.0.
</admonition>

  </definition>
  <definition term="xpack.fleet.agentPolicies[n].data_output_id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. ID of the output to send data. (Need to be identical to `monitoring_output_id`)
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].monitoring_output_id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. ID of the output to send monitoring data. (Need to be identical to `data_output_id`)
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].fleet_server_host_id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. ID of the fleet server.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].package_policies">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. List of integration policies to add to this policy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].package_policies[n].id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Unique ID of the integration policy. The ID may be a number or string.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].package_policies[n].name">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Name of the integration policy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].package_policies[n].package">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Integration that this policy configures.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].package_policies[n].package.name">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Name of the integration associated with this policy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].package_policies[n].description">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Text string describing this integration policy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].package_policies[n].namespace">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

String identifying this policy's namespace.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.agentPolicies[n].package_policies[n].inputs">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Map of input for the integration. Follows the same schema as the package policy API inputs, with the exception that any object in `vars` can be passed `frozen: true` in order to prevent that specific `var` from being edited by the user.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

List of outputs that are configured when the Fleet app starts.
Certain types of outputs have additional required and optional settings. Refer to [Output settings](https://www.elastic.co/docs/reference/fleet/fleet-settings#output-settings) in the Fleet and Elastic Agent Guide for the full list of settings for each output type.
If configured in your `kibana.yml`, output settings are grayed out and unavailable in the Fleet UI. To make these settings editable in the UI, do not configure them in the configuration file.
Datatype: `string`

<note>
  The `xpack.fleet.outputs` settings are intended for advanced configurations such as having multiple outputs. We recommend not enabling the `xpack.fleet.agents.elasticsearch.host` settings when using `xpack.fleet.outputs`.
</note>


```yaml
xpack.fleet.outputs:
  - id: my-logstash-output-with-a-secret
    name: preconfigured logstash output with a secret
    type:  logstash
    hosts: ["localhost:9999"]
    ssl:
      certificate: xxxxxxxxxx
    secrets:
      ssl:
        key: securekey
```

  </definition>
  <definition term="xpack.fleet.outputs[n].id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Unique ID for this output. The ID should be a string.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].name">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Name of the output.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].type">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Type of Output.
Datatype: `enum`
Options:
- `elasticsearch`
- `logstash`
- `kafka`
- `remote_elasticsearch`
  </definition>
  <definition term="xpack.fleet.outputs[n].hosts">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Array that contains the list of host for that output.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].is_default">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. If `true`, the output specified in `xpack.fleet.outputs` will be the one used to send agent data unless there is another one configured specifically for the agent policy.
Datatype: `bool`
  </definition>
  <definition term="xpack.fleet.outputs[n].is_default_monitoring">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. If `true`, the output specified in `xpack.fleet.outputs` will be the one used to send agent monitoring data unless there is another one configured specifically for the agent policy.
Datatype: `bool`
  </definition>
  <definition term="xpack.fleet.outputs[n].is_internal">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. If `true`, the output specified in `xpack.fleet.outputs` will not appear in the UI, and can only be managed via `kibana.yml` or the Fleet API.
Datatype: `bool`
  </definition>
  <definition term="xpack.fleet.outputs[n].config">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Extra config for that output.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].proxy_id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Unique ID of a proxy to access the output.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].ssl">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Set to enable authentication using the Secure Sockets Layer (SSL) protocol.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].ssl.certificate">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

The SSL certificate that Elastic Agents use to authenticate with the output. Include the full contents of the certificate here.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].ssl.certificate_authorities">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Certificate authority (CA) used to issue the certificate.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].secrets">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Include here any values for preconfigured outputs that should be stored as secrets. A secret value is replaced in the `kibana.yml` settings file with a reference, with the original value stored externally as a secure hash. Note that this type of secret storage requires all configured Fleet Servers to be on version 8.12.0 or later.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.outputs[n].secrets.key">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

The private certificate key that Elastic Agents use to authenticate with the output.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.fleetServerHosts">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

List of Fleet Server hosts that are configured when the Fleet app starts.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.fleetServerHosts[n].id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Unique ID for the host server.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.fleetServerHosts[n].name">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Name of the host server.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.fleetServerHosts[n].host_urls">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Array of one or more host URLs that Elastic Agents will use to connect to Fleet Server.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.fleetServerHosts[n].is_default">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Whether or not this host should be the default to use for Fleet Server.
Datatype: `bool`
  </definition>
  <definition term="xpack.fleet.fleetServerHosts[n].is_internal">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. If `true` the host will not appear in the UI, and can only be managed through `kibana.yml` or the Fleet API.
Datatype: `bool`
  </definition>
  <definition term="xpack.fleet.fleetServerHosts[n].proxy_id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Unique ID of the proxy to access the Fleet Server host.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

List of proxies to access Fleet Server that are configured when the Fleet app starts.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].id">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Unique ID of the proxy to access the Fleet Server host.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].name">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. Name of the proxy to access the Fleet Server host.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].url">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Required. URL that Elastic Agents use to connect to the proxy to access Fleet Server.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].proxy_headers">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Map of headers to use with the proxy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].proxy_headers.key">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Key to use for the proxy header.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].proxy_headers.value">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Value to use for the proxy header.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].certificate_authorities">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. Certificate authority (CA) used to issue the certificate.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].certificate">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. The name of the certificate used to authenticate the proxy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.proxy[n].certificate_key">
    <supported-on>Self-managed Elastic deployments: Generally available</supported-on>

Optional. The certificate key used to authenticate the proxy.
Datatype: `string`
  </definition>
  <definition term="xpack.fleet.enableExperimental">
    <stack-availability>Elastic Stack: Deprecated since 9.3</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

List of experimental feature flag to enable in Fleet.
It is available in Elastic Cloud 8.6.0 and later versions.
Deprecated beginning in 9.3.0.
Datatype: `string`

<admonition title="Deprecation details">
  From 9.3.0 onwards, use `xpack.fleet.experimentalFeatures` to explicitly enable or disable experimental features.
</admonition>

  </definition>
  <definition term="xpack.fleet.experimentalFeatures">
    <stack-availability>Elastic Stack: Generally available since 9.3</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set experimental feature flags to `true` or `false` to enable or disable them, respectively.
Datatype: `string`

<note>
  Experimental features should not be enabled in production environments. The features in this section are experimental and may be changed or removed completely in future releases. Elastic will make a best effort to fix any issues, but experimental features are not supported to the same level as generally available (GA) features.
</note>


```yaml
xpack.fleet.experimentalFeatures:
  useSpaceAwareness: false
  enableAgentPrivilegeLevelChange: true
```

  </definition>
  <definition term="xpack.fleet.enableManagedLogsAndMetricsDataviews">
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Set to `true` (default), to enable the automatic creation of global `logs-*` and `metrics-*` data views.
Datatype: `bool`
Default: `true`
  </definition>
  <definition term="xpack.fleet.autoUpgrades.taskInterval">
    <stack-availability>Elastic Stack: Generally available since 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Configure the interval of the automatic upgrade task for Fleet-managed Elastic Agents.
Datatype: `string`
Default: `30m`
  </definition>
  <definition term="xpack.fleet.autoUpgrades.retryDelays">
    <stack-availability>Elastic Stack: Generally available since 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Configure the retry delays of the automatic upgrade task for Fleet-managed Elastic Agents. The array's length indicates the maximum number of retries.
Datatype: `string`
Default: `['30m', '1h', '2h', '4h', '8h', '16h', '24h']`
  </definition>
  <definition term="xpack.fleet.integrationRollbackTTL">
    <stack-availability>Elastic Stack: Generally available since 9.3</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

Configure the time-to-live (TTL) for integration rollback availability. This setting controls how long the rollback option remains available after an integration is upgraded. The value must be specified in a duration format (for example, `7d`, `14d`, `168h`, or `1w`). For more information, refer to [Roll back an integration](https://www.elastic.co/docs/reference/fleet/roll-back-integration).
Datatype: `string`
Default: `7d`
  </definition>
  <definition term="xpack.fleet.fleetPolicyRevisionsCleanup.max_revisions">
    <stack-availability>Elastic Stack: Generally available since 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum number of revisions to maintain for a Fleet agent policy.
Datatype: `int`
Default: `10`
  </definition>
  <definition term="xpack.fleet.fleetPolicyRevisionsCleanup.interval">
    <stack-availability>Elastic Stack: Generally available since 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The time interval for performing cleanups of Fleet agent policy revisions. The value must be specified in a duration format (for example, `30m`, `1h`, `1d`).
Datatype: `string`
Default: `1h`
  </definition>
  <definition term="xpack.fleet.fleetPolicyRevisionsCleanup.max_policies_per_run">
    <stack-availability>Elastic Stack: Generally available since 9.1</stack-availability>
    <supported-on>Elastic Cloud Hosted: Generally available, Self-managed Elastic deployments: Generally available</supported-on>

The maximum number of Fleet agent policies to clean up revisions from per interval.
Datatype: `int`
Default: `100`
  </definition>
</definitions>