Agent and integration are heatlhy, but no logs from vm

Elastic Stack Elastic Agent
1

I installed an agent on a virtual machine to collect PostgreSQL logs through integration. The log paths are correct, and everything seems to be healthy.
However, the logs are not being sent to ELK, and no data stream is being created.

image
image1280×217 72.7 KB

Fleet server: docker.elastic.co/beats/elastic-agent:8.17.0
ELK: docker.elastic.co/elasticsearch/elasticsearch:8.17.0
Agent version: 8.17.3
Platform: ubuntu
The agent logs are empty.

diagnostic file isn't generating

2

image
image2010×611 28.5 KB

3

image
image2034×233 21.2 KB

4

What is the output of this policy?

Check if the VM can connect to the output, from what you described your agent cannot reach the configured output.

The healthy of the agent is only relative to the Fleet Server and if the integrations are running without issue, it does not take into consideration the communicaton from the agent to the configured output.

For example, if your output is Elasticsearch and your agent cannot reach Elasticsearch, but can reach the Fleet Server, it will appear as healthy, but you will have no data (also will not be able to get a diagnostic remotely).

You will need to check the log file directly in the server.

5

Yes, the output shows the internal elasticsearch URL, how to change it when or after installing an agent?

outputs:
  default:
    api_key: <REDACTED>
    hosts:
    - https://elasticsearch-es-http:9200
    preset: balanced
    type: elasticsearch
6

Is this output accessible to the agent?

If not you need to edit it Fleet Settings and configure it to the endpoint that it is accessible to the agent.

You can edit it in the Settings tab in the Fleet page.

1 Like