navigation_title

Command reference

mapped_pages

https://www.elastic.co/guide/en/fleet/current/elastic-agent-cmd-options.html

applies_to

stack	serverless
ga	ga

products

id
fleet

id
elastic-agent

{{agent}} command reference [elastic-agent-cmd-options]

{{agent}} provides commands for running {{agent}}, managing {{fleet-server}}, and doing common tasks. The commands listed here apply to both {{fleet}}-managed and standalone {{agent}}.

::::{admonition} Restrictions :class: important

Note the following restrictions for running {{agent}} commands:

You might need to log in as a root user (or Administrator on Windows) to run the commands described here. After the {{agent}} service is installed and running, make sure you run these commands without prepending them with ./ to avoid invoking the wrong binary.
Running {{agent}} commands using the Windows PowerShell ISE is not supported.

::::

:::{admonition} Command options for {{fleet-server}} :applies_to: serverless: unavailable Because self-managed {{fleet-server}} is not supported on {{serverless-full}}, the elastic-agent enroll and elastic-agent install options that configure {{fleet-server}} are not available on {{serverless-short}}. :::

diagnostics
enroll
help
inspect
install
otel
privileged
restart
run
status
uninstall
upgrade
logs
unprivileged
version

elastic-agent diagnostics [elastic-agent-diagnostics-command]

Gather diagnostics information from the {{agent}} and component/unit it’s running. This command produces an archive that contains:

version.txt - version information
agent-info.yaml - contains the agent local metadata that is also sent to Fleet
pre-config.yaml - pre-configuration before variable substitution - this is the elastic-agent.yaml from disk or from Fleet
otel.yaml - the OpenTelemetry collector configuration file used with the otel sub-command
otel-merged.yaml - the final configuration file provided to the OpenTelemetry collector, including any internally generated collector components
variables.yaml - current variable contexts from providers
environment.yaml - current environment variables visible to the Elastic Agent process
computed-config.yaml - configuration after variable substitution
components-expected.yaml - expected computed components model from the computed-config.yaml
components-actual.yaml - actual running components model as reported by the runtime manager
state.yaml - current state information of all running components
*.pprof.gz files from the running elastic-agent process for analysis with go tool pprof:
- goroutine.pprof.gz - goroutine dump
- heap.pprof.gz - memory allocation of live objects
- allocs.pprof.gz - sampling past memory allocations
- threadcreate.pprof.gz - traces led to creation of new OS threads
- block.pprof.gz - stack traces that led to blocking on synchronization primitives
- mutex.pprof.gz - stack traces of holders of contended mutexes
components/ directory - diagnostic information from each running component process:
- Typically one directory per input-output pair representing a supervised process containing:
  - *.pprof.gz - profiles for analysis with go tool pprof; refer to the previous descriptions
  - *_metrics.json - metrics snapshots captured from running Beat processes
edot/ directory - the output of Elastic's collector diagnostics extension:
- otel-merged-actual.yaml - the current configuration of the running collector, which should match the otel-merged.yaml file described previously
- *.profile.gz - profiles for analysis with go tool pprof; refer to the previous descriptions

Note that credentials may not be redacted in the archive; they may appear in plain text in the configuration or policy files inside the archive.

This command is intended for debugging purposes only. The output format and structure of the archive may change between releases.

Synopsis [_synopsis]

elastic-agent diagnostics [--file <string>]
                          [--cpu-profile]
                          [--exclude-events]
                          [--help]
                          [global-flags]

Options [_options]

--file : Specifies the output archive name. Defaults to elastic-agent-diagnostics-<timestamp>.zip, where the timestamp is the current time in UTC.

--help : Show help for the diagnostics command.

--cpu-profile : Additionally runs a 30-second CPU profile on each running component. This will generate an additional cpu.pprof file for each component.

--p : Alias for --cpu-profile.

--exclude-events : Exclude the events log files from the diagnostics archive.

For more flags, see Global flags.

Example [_example_38]

elastic-agent diagnostics

elastic-agent enroll [elastic-agent-enroll-command]

Enroll the {{agent}} in {{fleet}}.

Use this command to enroll the {{agent}} in {{fleet}} without installing the agent as a service. You will need to do this if you installed the {{agent}} from a DEB or RPM package and plan to use systemd commands to start and manage the service. This command is also useful for testing {{agent}} prior to installing it.

If you’ve already installed {{agent}}, use this command to modify the settings that {{agent}} runs with.

::::{tip} To enroll an {{agent}} and install it as a service, use the install command instead. Installing as a service is the most common scenario. ::::

We recommend that you run the enroll (or install) command as the root user because some integrations require root privileges to collect sensitive data. This command overwrites the elastic-agent.yml file in the agent directory.

This command includes optional flags to set up {{fleet-server}}.

::::{important} This command enrolls the {{agent}} in {{fleet}}; it does not start the agent. To start the agent, either start the service, if one exists, or use the run command to start the agent from a terminal. ::::

Synopsis [_synopsis_2]

To enroll the {{agent}} in {{fleet}}:

elastic-agent enroll --url <string>
                     --enrollment-token <string>
                     [--ca-sha256 <string>]
                     [--certificate-authorities <string>]
                     [--daemon-timeout <duration>]
                     [--delay-enroll]
                     [--elastic-agent-cert <string>]
                     [--elastic-agent-cert-key <string>]
                     [--elastic-agent-cert-key-passphrase <string>]
                     [--force]
                     [--header <strings>]
                     [--help]
                     [--id <string>]
                     [--insecure ]
                     [--proxy-disabled]
                     [--proxy-header <strings>]
                     [--proxy-url <string>]
                     [--replace-token <string>]
                     [--staging <string>]
                     [--tag <string>]
                     [global-flags]

To enroll the {{agent}} in {{fleet}} and set up {{fleet-server}}:

elastic-agent enroll --fleet-server-es <string>
                     --fleet-server-service-token <string>
                     [--fleet-server-service-token-path <string>]
                     [--ca-sha256 <string>]
                     [--certificate-authorities <string>]
                     [--daemon-timeout <duration>]
                     [--delay-enroll]
                     [--elastic-agent-cert <string>]
                     [--elastic-agent-cert-key <string>]
                     [--elastic-agent-cert-key-passphrase <string>]
                     [--fleet-server-cert <string>] <1>
                     [--fleet-server-cert-key <string>]
                     [--fleet-server-cert-key-passphrase <string>]
                     [--fleet-server-client-auth <string>]
                     [--fleet-server-es-ca <string>]
                     [--fleet-server-es-ca-trusted-fingerprint <string>] <2>
                     [--fleet-server-es-cert <string>]
                     [--fleet-server-es-cert-key <string>]
                     [--fleet-server-es-insecure]
                     [--fleet-server-host <string>]
                     [--fleet-server-policy <string>]
                     [--fleet-server-port <uint16>]
                     [--fleet-server-timeout <duration>]
                     [--force]
                     [--header <strings>]
                     [--help]
                     [--proxy-disabled]
                     [--proxy-header <strings>]
                     [--proxy-url <string>]
                     [--staging <string>]
                     [--tag <string>]
                     [--url <string>] <3>
                     [global-flags]

If no fleet-server-cert* flags are specified, {{agent}} auto-generates a self-signed certificate with the hostname of the machine. Remote {{agent}}s enrolling into a {{fleet-server}} with self-signed certificates must specify the --insecure flag.
Required when using self-signed certificates with {{es}}.
Required when enrolling in a {{fleet-server}} with custom certificates. The URL must match the DNS name used to generate the certificate specified by --fleet-server-cert.

For more information about custom certificates, refer to Configure SSL/TLS for self-managed {{fleet-server}}s.

Options [_options_2]

--ca-sha256 <string> : Comma-separated list of certificate authority hash pins used for certificate verification.

--certificate-authorities <string> : Comma-separated list of root certificates used for server verification.

--daemon-timeout <duration> : Timeout waiting for {{agent}} daemon.

--delay-enroll : Delays enrollment to occur on first start of the {{agent}} service. This setting is useful when you don't want the {{agent}} to enroll until the next reboot or manual start of the service, for example, when you're preparing an image that includes {{agent}} or deploying to environments where network access may not be immediately available. If {{fleet-server}} is unreachable when the service starts, {{agent}} will retry enrollment indefinitely until it succeeds.

--elastic-agent-cert : Certificate to use as the client certificate for the {{agent}}'s connections to {{fleet-server}}.

--elastic-agent-cert-key : Private key to use as for the {{agent}}'s connections to {{fleet-server}}.

--elastic-agent-cert-key-passphrase : The path to the file that contains the passphrase for the mutual TLS private key that {{agent}} will use to connect to {{fleet-server}}. The file must only contain the characters of the passphrase, no newline or extra non-printing characters.

This option is only used if the `--elastic-agent-cert-key` is encrypted and requires a passphrase to use.

--enrollment-token <string> : Enrollment token to use to enroll {{agent}} into {{fleet}}. You can use the same enrollment token for multiple agents.

--fleet-server-cert <string> {applies_to}serverless: unavailable : Certificate to use for exposed {{fleet-server}} HTTPS endpoint.

--fleet-server-cert-key <string> {applies_to}serverless: unavailable : Private key to use for exposed {{fleet-server}} HTTPS endpoint.

--fleet-server-cert-key-passphrase <string> {applies_to}serverless: unavailable : Path to passphrase file for decrypting {{fleet-server}}'s private key if an encrypted private key is used.

--fleet-server-client-auth <string> {applies_to}serverless: unavailable : One of none, optional, or required. Defaults to none. {{fleet-server}}'s client_authentication option for client mTLS connections. If optional, or required is specified, client certificates are verified using CAs specified in the --certificate-authorities flag.

--fleet-server-es <string> {applies_to}serverless: unavailable : Start a {{fleet-server}} process when {{agent}} is started, and connect to the specified {{es}} URL.

--fleet-server-es-ca <string> {applies_to}serverless: unavailable : Path to certificate authority file to use to communicate with {{es}}. This is an alternative to using --fleet-server-es-ca-trusted-fingerprint.

--fleet-server-es-ca-trusted-fingerprint <string> {applies_to}serverless: unavailable : The SHA-256 fingerprint (hash) of a certificate authority that is present in the certificate chain sent by {{es}} during the TLS handshake. If this certificate is found in the chain, it will be added to the trusted CAs. This is an alternative to using --fleet-server-es-ca to provide a CA certificate file. For more information, refer to Using certificate fingerprints.

--fleet-server-es-cert {applies_to}serverless: unavailable : The path to the client certificate that {{fleet-server}} will use when connecting to {{es}}.

--fleet-server-es-cert-key {applies_to}serverless: unavailable : The path to the private key that {{fleet-server}} will use when connecting to {{es}}.

--fleet-server-es-insecure {applies_to}serverless: unavailable : Allows fleet server to connect to {{es}} in the following situations:

* When connecting to an HTTP server.
* When connecting to an HTTPs server and the certificate chain cannot be verified. The content is encrypted, but the certificate is not verified.

When this flag is used the certificate verification is disabled.

--fleet-server-host <string> {applies_to}serverless: unavailable : {{fleet-server}} HTTP binding host (overrides the policy).

--fleet-server-policy <string> {applies_to}serverless: unavailable : Used when starting a self-managed {{fleet-server}} to allow a specific policy to be used.

--fleet-server-port <uint16> {applies_to}serverless: unavailable : {{fleet-server}} HTTP binding port (overrides the policy).

--fleet-server-service-token <string> {applies_to}serverless: unavailable : Service token to use for communication with {{es}}. Mutually exclusive with --fleet-server-service-token-path.

--fleet-server-service-token-path <string> {applies_to}serverless: unavailable : Service token file to use for communication with {{es}}. Mutually exclusive with --fleet-server-service-token.

--fleet-server-timeout <duration> {applies_to}serverless: unavailable : Timeout waiting for {{fleet-server}} to be ready to start enrollment.

--force : Force overwrite of current configuration without prompting for confirmation. This flag is helpful when using automation software or scripted deployments.

::::{note}
If the {{agent}} is already installed on the host, using `--force` may result in unpredictable behavior with duplicate {{agent}}s appearing in {{fleet}}.
::::

--header <strings> : Headers used in communication with elasticsearch.

--help : Show help for the enroll command.

--id <string> : Specifies the unique identifier (agent ID) to use when enrolling the {{agent}} with {{fleet-server}}. This setting is useful when restoring a previously enrolled agent or in stateless environments where the agent cannot persist enrollment data between redeployments.

:::{note}
If an agent with the same ID is already enrolled in {{fleet}}, enrollment will fail unless a valid replacement token is provided using the `--replace-token` flag.
:::

--insecure : Allow the {{agent}} to connect to {{fleet-server}} over insecure connections. This setting is required in the following situations:

* When connecting to an HTTP server. The API keys are sent in clear text.
* When connecting to an HTTPs server and the certificate chain cannot be verified. The content is encrypted, but the certificate is not verified.
* When using self-signed certificates generated by {{agent}}.

We strongly recommend that you use a secure connection.

--proxy-disabled : Disable proxy support including environment variables.

--proxy-header <strings> : Proxy headers used with CONNECT request.

--proxy-url <string> : Configures the proxy URL.

--replace-token <string> : Specifies a token that can be used to replace the {{agent}} after its enrollment in {{fleet-server}}. The token must be provided when enrolling an agent with a specific agent ID for the first time. Subsequently, the agent can be replaced by enrolling another agent using the same agent ID and replacement token. Once replaced, the original agent can no longer communicate with {{fleet}}.

:::{note}
If an {{agent}} is enrolled without a replacement token, it cannot be replaced by another agent with the same ID. This mechanism prevents accidental or malicious takeovers by requiring the replacement token to match the hashed token stored in {{fleet}}.
:::

--staging <string> : Configures agent to download artifacts from a staging build.

--tag <string> : A comma-separated list of tags to apply to {{fleet}}-managed {{agent}}s. You can use these tags to filter the list of agents in {{fleet}}.

::::{note}
Currently, there is no way to remove or edit existing tags. To change the tags, you must unenroll the {{agent}}, then re-enroll it using new tags.
::::

--url <string> : {{fleet-server}} URL to use to enroll the {{agent}} into {{fleet}}.

For more flags, see Global flags.

Examples [_examples_11]

Enroll the {{agent}} in {{fleet}}:

elastic-agent enroll \
  --url=https://cedd4e0e21e240b4s2bbbebdf1d6d52f.fleet.eu-west-1.aws.cld.elstc.co:443 \
  --enrollment-token=NEFmVllaa0JLRXhKebVKVTR5TTI6N2JaVlJpSGpScmV0ZUVnZVlRUExFQQ==

Enroll the {{agent}} in {{fleet}} and set up {{fleet-server}}:

elastic-agent enroll --fleet-server-es=http://elasticsearch:9200 \
  --fleet-server-service-token=AbEAAdesYXN1abMvZmxlZXQtc2VldmVyL3Rva2VuLTE2MTkxMzg3MzIzMTg7dzEta0JDTmZUcGlDTjlwRmNVTjNVQQ \
  --fleet-server-policy=a35fd520-26f5-11ec-8bd9-3374690g57b6

Start {{agent}} with {{fleet-server}} (running on a custom CA). This example assumes you’ve generated the certificates with the following names:

ca.crt: Root CA certificate
fleet-server.crt: {{fleet-server}} certificate
fleet-server.key: {{fleet-server}} private key
elasticsearch-ca.crt: CA certificate to use to connect to {{es}}

elastic-agent enroll \
  --url=https://fleet-server:8220 \
  --fleet-server-es=https://elasticsearch:9200 \
  --fleet-server-service-token=AAEBAWVsYXm0aWMvZmxlZXQtc2XydmVyL3Rva2VuLTE2MjM4OTAztDU1OTQ6dllfVW1mYnFTVjJwTC2ZQ0EtVnVZQQ \
  --fleet-server-policy=a35fd520-26f5-11ec-8bd9-3374690g57b6 \
  --certificate-authorities=/path/to/ca.crt \
  --fleet-server-es-ca=/path/to/elasticsearch-ca.crt \
  --fleet-server-cert=/path/to/fleet-server.crt \
  --fleet-server-cert-key=/path/to/fleet-server.key \
  --fleet-server-port=8220

Then enroll another {{agent}} into the {{fleet-server}} started in the previous example:

elastic-agent enroll --url=https://fleet-server:8220 \
  --enrollment-token=NEFmVllaa0JLRXhKebVKVTR5TTI6N2JaVlJpSGpScmV0ZUVnZVlRUExFQQ== \
  --certificate-authorities=/path/to/ca.crt

Replace an {{agent}} enrolled in {{fleet-server}} with a specific agent ID and a replacement token:

elastic-agent enroll \
  --url=https://fleet-server:8220 \
  --enrollment-token=ENROLLMENT_TOKEN_HASH \
  --id=MY_AGENT_ID \
  --replace-token=REPLACEMENT_TOKEN_HASH

elastic-agent help [elastic-agent-help-command]

Show help for a specific command.

Synopsis [_synopsis_3]

elastic-agent help <command> [--help] [global-flags]

Options [_options_3]

command : The name of the command.

--help : Show help for the help command.

For more flags, see Global flags.

Example [_example_39]

elastic-agent help enroll

elastic-agent inspect [elastic-agent-inspect-command]

Show the current {{agent}} configuration. Use this command to verify and troubleshoot the configuration that {{agent}} is using, including variable substitution and the computed components model.

If no flags are specified, the command shows the full {{agent}} configuration. By default, variable substitution is not performed, and the raw configuration is displayed.

Use the --variables flag to enable variable substitution. The first set of computed variables are used when only the --variables flag is defined. This can prevent some of the dynamic providers like {{k8s}} and Docker from providing all the possible variables they could have discovered if given more time. Use the --variables-wait flag to specify an amount of time to wait for variable discovery before using the variables for the configuration.

Use the components subcommand to view the components model. Components represent individual processes running underneath {{agent}}, such as {{filebeat}} or {{endpoint-sec}}. Units represent discrete configuration units within a component, such as {{filebeat}} inputs or {{metricbeat}} modules.

Synopsis [_synopsis_4]

elastic-agent inspect [--variables]
                      [--monitoring]
                      [--variables-wait <duration>]
                      [--help]
                      [global-flags]
elastic-agent inspect components [--show-config]
                                 [--show-spec]
                                 [--variables-wait <duration>]
                                 [--help]
                                 [<component_id>]
                                 [<component_id>/<unit_id>]

Available commands [_available_commands_inspect]

components : Display the generated components model for the current configuration. Variable substitution is always performed when computing the components model and cannot be disabled. By default, only the first set of computed variables are used. Use the --variables-wait flag to allow more time for dynamic providers to discover variables.

This command accepts the following arguments and flags:

`<component_id>`
:   Select a specific component by its ID. Only that component and all its units are returned. Use `elastic-agent inspect components` without an ID to see all available component IDs. Configuration for units is not shown by default; use `--show-config` to display it.

`<component_id>/<unit_id>`
:   Select a specific unit inside a component by specifying both the component ID and unit ID separated by a forward slash. In this mode, the unit configuration is shown by default.

`--show-config`
:   Display the configuration for all units. By default, unit configuration is hidden unless you select a specific unit using the `<component_id>/<unit_id>` format.

`--show-spec`
:   Display the input/output runtime specification for a component. By default, the runtime specification is hidden.

`--variables-wait <duration>`
:   Wait the specified amount of time for variable discovery before computing the components model. This is useful when using dynamic providers like {{k8s}} or Docker that may need additional time to discover all available variables.

Options [_options_4]

--variables : Render the configuration with variables substituted. When not specified, the raw configuration is displayed without variable substitution.

--monitoring : Include the monitoring configuration in the output. This option implies --variables, as the monitoring configuration requires variable substitution.

--variables-wait <duration> : Wait the specified amount of time for variable discovery before performing substitution. This is useful when using dynamic providers like {{k8s}} or Docker that may need additional time to discover all available variables. Implies --variables. For example, --variables-wait 30s.

--help : Show help for the inspect command.

For more flags, see Global flags.

Examples [_examples_12]

Show the raw {{agent}} configuration without variable substitution:

elastic-agent inspect

Show the configuration with variables substituted:

elastic-agent inspect --variables

Show the configuration with variables substituted, waiting 30 seconds for dynamic providers to discover variables:

elastic-agent inspect --variables-wait 30s

Show the configuration including monitoring settings:

elastic-agent inspect --monitoring

Display all components:

elastic-agent inspect components

Display all components with their unit configurations:

elastic-agent inspect components --show-config

Display a specific component by ID:

elastic-agent inspect components log-default

Display a specific component with its runtime specification:

elastic-agent inspect components log-default --show-spec

Display a specific unit inside a component:

elastic-agent inspect components log-default/log-default

Wait 30 seconds for dynamic providers before computing components:

elastic-agent inspect components --variables-wait 30s

elastic-agent privileged [elastic-agent-privileged-command]

Run {{agent}} with full superuser privileges. This is the usual, default running mode for {{agent}}. The privileged command allows you to switch back to running an agent with full administrative privileges when you have been running it in unprivileged mode.

Refer to Run {{agent}} without administrative privileges for more detail.

Examples [_examples_13]

elastic-agent privileged

elastic-agent install [elastic-agent-install-command]

Install {{agent}} permanently on the system and manage it by using the system’s service manager. The agent will start automatically after installation is complete. On Linux (tar package), this command requires a system and service manager like systemd.

::::{important} If you installed {{agent}} from a DEB or RPM package, the install command will skip the installation itself and function as an alias of the enroll command instead. After an upgrade of the {{agent}} using DEB or RPM the {{agent}} service needs to be restarted. ::::

You must run this command as the root user (or Administrator on Windows) to write files to the correct locations. This command overwrites the elastic-agent.yml file in the agent directory.

The syntax for running this command varies by platform. As well, various flavors of the agent install package are available, allowing you to control the installed package size on disk and the set of included components. For platform-specific examples and for details about the available flavors, refer to Install {{agent}}s.

Synopsis [_synopsis_5]

To install the {{agent}} as a service, enroll it in {{fleet}}, and start the elastic-agent service:

elastic-agent install --url <string>
                      --enrollment-token <string>
                      [--base-path <string>]
                      [--ca-sha256 <string>]
                      [--certificate-authorities <string>]
                      [--daemon-timeout <duration>]
                      [--delay-enroll]
                      [--elastic-agent-cert <string>]
                      [--elastic-agent-cert-key <string>]
                      [--elastic-agent-cert-key-passphrase <string>]
                      [--force]
                      [--header <strings>]
                      [--help]
                      [--insecure ]
                      [--non-interactive]
                      [--privileged]
                      [--proxy-disabled]
                      [--proxy-header <strings>]
                      [--proxy-url <string>]
                      [--staging <string>]
                      [--tag <string>]
                      [--unprivileged]
                      [global-flags]

To install the {{agent}} as a service, enroll it in {{fleet}}, and start a fleet-server process alongside the elastic-agent service:

elastic-agent install --fleet-server-es <string>
                      --fleet-server-service-token <string>
                      [--fleet-server-service-token-path <string>]
                      [--base-path <string>]
                      [--ca-sha256 <string>]
                      [--certificate-authorities <string>]
                      [--daemon-timeout <duration>]
                      [--delay-enroll]
                      [--elastic-agent-cert <string>]
                      [--elastic-agent-cert-key <string>]
                      [--elastic-agent-cert-key-passphrase <string>]
                      [--fleet-server-cert <string>] <1>
                      [--fleet-server-cert-key <string>]
                      [--fleet-server-cert-key-passphrase <string>]
                      [--fleet-server-client-auth <string>]
                      [--fleet-server-es-ca <string>]
                      [--fleet-server-es-ca-trusted-fingerprint <string>] <2>
                      [--fleet-server-es-cert <string>]
                      [--fleet-server-es-cert-key <string>]
                      [--fleet-server-es-insecure]
                      [--fleet-server-host <string>]
                      [--fleet-server-policy <string>]
                      [--fleet-server-port <uint16>]
                      [--fleet-server-timeout <duration>]
                      [--force]
                      [--header <strings>]
                      [--help]
                      [--non-interactive]
                      [--privileged]
                      [--proxy-disabled]
                      [--proxy-header <strings>]
                      [--proxy-url <string>]
                      [--staging <string>]
                      [--tag <string>]
                      [--unprivileged]
                      [--url <string>] <3>
                      [global-flags]

If no fleet-server-cert* flags are specified, {{agent}} auto-generates a self-signed certificate with the hostname of the machine. Remote {{agent}}s enrolling into a {{fleet-server}} with self-signed certificates must specify the --insecure flag.
Required when using self-signed certificate on {{es}} side.
Required when enrolling in a {{fleet-server}} with custom certificates. The URL must match the DNS name used to generate the certificate specified by --fleet-server-cert.

For more information about custom certificates, refer to Configure SSL/TLS for self-managed {{fleet-server}}s.

Options [_options_5]

--base-path <string> : Install {{agent}} in a location other than the default. Specify the custom base path for the install.

The `--base-path` option is not currently supported with [{{elastic-defend}}](/solutions/security/configure-elastic-defend/install-elastic-defend.md).

--ca-sha256 <string> : Comma-separated list of certificate authority hash pins used for certificate verification.

--certificate-authorities <string> : Comma-separated list of root certificates used for server verification.

--daemon-timeout <duration> : Timeout waiting for {{agent}} daemon.

--delay-enroll : Delays enrollment to occur on first start of the {{agent}} service. This setting is useful when you don’t want the {{agent}} to enroll until the next reboot or manual start of the service, for example, when you’re preparing an image that includes {{agent}}.

--elastic-agent-cert : Certificate to use as the client certificate for the {{agent}}'s connections to {{fleet-server}}.

--elastic-agent-cert-key : Private key to use as for the {{agent}}'s connections to {{fleet-server}}.

This option is only used if the `--elastic-agent-cert-key` is encrypted and requires a passphrase to use.