Loading

Fleet and Elastic Agent breaking changes

Breaking changes can impact your Elastic applications, potentially disrupting normal operations. Before you upgrade, carefully review the Fleet and Elastic Agent breaking changes and take the necessary steps to mitigate any issues. To learn how to upgrade, check Upgrade.

Release date: April 2, 2025

Removed deprecated `epm` Fleet APIs

Removed GET/POST/DELETE /epm/packages/:pkgkey APIs in favor of the GET/POST/DELETE /epm/packages/:pkgName/:pkgVersion.

Impact

  • Removed experimental query parameter in GET /epm/packages and GET /epm/categories
  • Removed response in response in * /epm/packages* and GET /epm/categories
  • Removed savedObject in /epm/packages response in favor of installationInfo

For more information, check #198434.

Removed deprecated Fleet APIs for agents endpoints

Removed the following API endpoints:

  • POST /service-tokens in favor of POST /service_tokens
  • GET /agent-status in favor GET /agent_status
  • PUT /agents/:agentid/reassign in favor of POST /agents/:agentid/reassign

Removed deprecated parameters or responses:

  • Removed total from GET /agent_status response
  • Removed list from GET /agents response

For more information, check #198313.

Removed `cloud defend` support for Elastic Agent

Support for cloud-defend (Defend for Containers) has been removed. The package has been removed from the Elastic Agent packaging scripts and template Kubernetes files.

For more information, check #5481.

Removed `username` and `password` default values for Elastic Agent

The default values for username and password have been removed for when Elastic Agent is running in container mode. The {es} api_key can now be set in that mode using the ELASTICSEARCH_API_KEY environment variable.

For more information, check #5536.

Changed Ubuntu-based Docker images for Elastic Agent

The default Ubuntu-based Docker images used for Elastic Agent have been changed to UBI-minimal-based images, to reduce the overall footprint of the agent Docker images and to improve compliance with enterprise standards.

For more information, check #6427.

Removed `--path.install` flag declaration from Elastic Agent `paths` command

The deprecated --path.install flag declaration has been removed from the Elastic Agent paths command and its use removed from the container and enroll commands.

For more information, check #6461 and #2489.

Changed the default Elastic Agent installation and upgrade

The default Elastic Agent installation and ugprade have been changed to include only the agentbeat, endpoint-security and pf-host-agent components. Additional components can be included using flags.

For more information, check #6542.

Removed deprecated settings API endpoints in Fleet
  • GET/DELETE/POST enrollment-api-keys: removed in favor of GET/DELETE/POST enrollment_api_keys
  • Removed list property from GET enrollment_api_keys response in favor of items
  • GET/POST /settings: fleet_server_hosts was removed from the response and body

For more information, check #198799.

Removed deprecated settings API endpoints in Fleet
  • GET/DELETE/POST enrollment-api-keys: removed in favor of GET/DELETE/POST enrollment_api_keys
  • Removed list property from GET enrollment_api_keys response in favor of items
  • GET/POST /settings: fleet_server_hosts was removed from the response and body

For more information, check #198799.

Removed deprecated `topics` property for kafka output in favor of the `topic` property

Removed deprecated property topics from output APIs in response and requests ((GET|POST|PUT) /api/fleet/outputs) in favor of the topic property.

For more information, check #199226.

Limit pagination size to 100 when retrieving full policy or `withAgentCount` in Fleet

In addition to the new pagination limit size of 100, retrieving agent policies without agent count is now the new default behavior, and a new query parameter withAgentCount was added to retrieve the agent count.

For more information, check #196887.