Elastic Agent ID Conflicts

[RBrownSoME]

I am finding that due to servers with Elastic Agent having been cloned in my environment, I am running into issues with duplicate Agent IDs that are conflicting with one another. I found the elastic-agent enroll command that can be run and will reset the agent id. Is this the best way to fix my issue, or is an uninstall/reinstall of the agent needed? If re-enrolling works, what arguments do I need to include when the command is run to ensure it still works with Security Onion?

I'm on v2.4.180, with Elastic Agent versions 8.17.3 and 8.18.6.

Thank you!

[octothorp88]

To change the agent id you can reenroll the agent using the enroll command.

elastic-agent enroll --enrollment-token=EnrollmentToken --url=https://FleetServer:8220

• The Enrollment Token can be obtained from Elastic Fleet -> Enrollment tokens.
• The Fleet Server URL is located on Elastic Fleet -> settings under grid-default