# I've had it with Elastic

**URL:** <https://taggartinstitute.org/t/ive-had-it-with-elastic/750>\
**Category:** General\
**Tags:** siem, blueteam, elastic\
**Created:** [July 9, 2026, 10:04pm UTC](https://taggartinstitute.org/t/ive-had-it-with-elastic/750 "2026-07-09T22:04:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mttaggart](https://taggartinstitute.org/user_avatar/taggartinstitute.org/mttaggart/32/10_2.png) [@mttaggart](https://taggartinstitute.org/u/mttaggart)\
**Post date:** [July 9, 2026, 10:04pm UTC](https://taggartinstitute.org/t/ive-had-it-with-elastic/750/1 "2026-07-09T22:04:43Z")

</div>

After four days of fighting with trying to automate setup of Fleet, I think I might toss it out of the Almanac entirely. We’ll see. But I was informed that the documentation is now slop-heavy, and that tracks.

Exhibit A: [Create a package policy | Kibana API documentation](https://www.elastic.co/docs/api/doc/kibana/operation/operation-post-fleet-package-policies)

If you look at the example there, you’ll see that the `inputs` POST parameter is a JSON object. And yet, if you look at the schema docs, it claims it is an array. Attempting either request via the API results in a schema validation fail. Arrays demand objects; objects demand arrays. Consequently, you cannot automatically create a full Fleet Server policy via the API. You must point-and-click in the UI (which magically bypasses schema validation?) after installation.

But if this is broken, I’m worried about what else is.