Elastic agent does not send data

Hello,

I am trying to use ingest management and elastic agent on Windows Server 2012 against elastic cloud instance. Unfortunately, I am ending with the error bellow and no data is sent to elastic.

Can someone please help me with this?

Thank you very much.

Pavel

2020-06-29T22:28:44+02:00 INFO  stateresolver.go:47     New State ID is _-m5mkG0
2020-06-29T22:28:44+02:00 INFO  stateresolver.go:48     Converging state requires execution of 3 step(s)
2020-06-29T22:28:44+02:00 DEBUG operator.go:236 operator is looking for filebeat--7.8.0 in app collection: map[]
2020-06-29T22:28:44+02:00 INFO  operation_fetch.go:65   filebeat.7.8.0 already exists in C:\Program Files\Elastic-Agent\
data\downloads\filebeat-7.8.0-windows-x86_64.zip. Skipping operation operation-fetch
2020-06-29T22:28:44+02:00 INFO  operator.go:217 operation 'operation-fetch' skipped for filebeat.7.8.0
2020-06-29T22:28:44+02:00 INFO  operator.go:217 operation 'operation-verify' skipped for filebeat.7.8.0
2020-06-29T22:28:44+02:00 DEBUG operator.go:221 running operation 'operation-install' for filebeat.7.8.0
2020-06-29T22:28:45+02:00 ERROR reporter.go:47  2020-06-29T22:28:45+02:00: type: 'ERROR': sub_type: 'CONFIG' message: Ap
plication: filebeat[e1c9a6cf-852d-477e-b17e-e19fc6da241e]: operation-install: exit status 1
2020-06-29T22:28:45+02:00 DEBUG action_dispatcher.go:93 Failed to dispatch action 'action_id: a46ce0db-9abc-440d-9f39-95
d1eaf01826, type: CONFIG_CHANGE', error: operator: failed to execute step sc-run, error: operation-install: exit status
1: operation-install: exit status 1
        operator: failed to execute step sc-run, error: operation-install: exit status 1: operation-install: exit status
 1
        operation-install: exit status 1
        exit status 1
2020-06-29T22:28:45+02:00 ERROR fleet_gateway.go:163    failed to dispatch actions, error: operator: failed to execute s
tep sc-run, error: operation-install: exit status 1: operation-install: exit status 1
        operator: failed to execute step sc-run, error: operation-install: exit status 1: operation-install: exit status
 1
        operation-install: exit status 1
        exit status 1
2020-06-29T22:28:45+02:00 DEBUG fleet_gateway.go:166    FleetGateway is sleeping, next update in 30s

Hello! I'm new to SDH issues, and new-ish to the ingest product but wanted to give some minimal help if I could. I'm sure others on the team will join in soon.

It is possible this is the same issue I've logged here:

We are prioritizing and hoping to make progress shortly.

  • is it possible for the immediate term for you to evaluate Ingest Manager and fleet with a different flavor of Windows? Win 7, Win 10, Win 8.1, Win 2019 are among the os versions we explicitly confirmed, per our support matrix listing for 7.8.

While I ask that.. I can ask more about the issue at hand, too:
One of the first things we would seek to trouble shoot is whether or not the host can communicate with Kibana. Can you confirm that using a 'ping' command or curl or similar returns successfully? If not the problem is in the networking / communication there.

If that works, perhaps you could post the configuration you are using when starting the Agent (are you trying to follow 'stand-alone' agent mode usage) or you can post the configuration yaml from the Ingest Manager UI in Kibana if you are following the Fleet-controlled Agent usage.

Regards.

Hello!

Thank you for your answer, the issue you sent looks the same as the one I have. I am looking for the version 7.9.x where it should be fixed. Is there any chance to get the fixed version before? For the other questions, I could give it a try on WIn 2019, maybe Win 10.

To the issue, host can definitely communicate with Kibana, it is listed in fleet as online/error and has the activity log with items in it. The configuration is the fleet mode one, yaml attached.

Thank you,

id: a7e9af70-ba3e-11ea-977e-b370193d06b6
revision: 7
outputs:
  default:
    type: elasticsearch
    hosts:
      - >-
        https://a1d50438db3047cf8c6e2f1bdfbe407f.northeurope.azure.elastic-cloud.com:443
datasources:
  - id: aeebd050-ba3e-11ea-977e-b370193d06b6
    name: system-1
    enabled: true
    package:
      name: system
      version: 0.3.0
    namespace: default
    use_output: default
    inputs:
      - type: logs
        enabled: true
        streams:
          - id: logs-system.auth
            enabled: true
            dataset: system.auth
            exclude_files:
              - .gz$
            paths:
              - /var/log/auth.log*
              - /var/log/secure*
            multiline:
              pattern: ^\s
              match: after
            processors:
              - add_locale: null
              - add_fields:
                  fields:
                    ecs.version: 1.5.0
                  target: ''
          - id: logs-system.syslog
            enabled: true
            dataset: system.syslog
            exclude_files:
              - .gz$
            paths:
              - /var/log/messages*
              - /var/log/syslog*
            multiline:
              pattern: ^\s
              match: after
            processors:
              - add_locale: null
              - add_fields:
                  fields:
                    ecs.version: 1.5.0
                  target: ''
      - type: system/metrics
        enabled: true
        streams:
          - id: system/metrics-system.cpu
            enabled: true
            dataset: system.cpu
            period: 10s
            cpu.metrics:
              - percentages
              - normalized_percentages
            metricsets:
              - cpu
          - id: system/metrics-system.diskio
            enabled: true
            dataset: system.diskio
            period: 10s
            diskio.include_devices: null
            metricsets:
              - diskio
          - id: system/metrics-system.fsstat
            enabled: true
            dataset: system.fsstat
            period: 1m
            metricsets:
              - fsstat
            processors:
              - drop_event.when.regexp:
                  system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
          - id: system/metrics-system.load
            enabled: true
            dataset: system.load
            period: 10s
            metricsets:
              - load
          - id: system/metrics-system.memory
            enabled: true
            dataset: system.memory
            period: 10s
            metricsets:
              - memory
          - id: system/metrics-system.network
            enabled: true
            dataset: system.network
            period: 10s
            network.interfaces: null
            metricsets:
              - network
          - id: system/metrics-system.process
            enabled: true
            dataset: system.process
            process.include_top_n.by_memory: 5
            period: 10s
            processes:
              - .*
            process.include_top_n.by_cpu: 5
            process.cgroups.enabled: true
            process.cmdline.cache.enabled: true
            metricsets:
              - process
          - id: system/metrics-system.process_summary
            enabled: true
            dataset: system.process_summary
            period: 10s
            metricsets:
              - process_summary
          - id: system/metrics-system.socket_summary
            enabled: true
            dataset: system.socket_summary
            period: 10s
            metricsets:
              - socket_summary
          - id: system/metrics-system.uptime
            enabled: true
            dataset: system.uptime
            period: 10s
            metricsets:
              - uptime
  - id: 1d7c48c0-bab6-11ea-977e-b370193d06b6
    name: log-1
    enabled: true
    package:
      name: log
      version: 0.1.0
    namespace: default
    use_output: default
    inputs:
      - type: logs
        enabled: true
        streams:
          - id: logs-generic
            type: log
            enabled: true
            dataset: generic
            paths:
              - 'd:/data/logfiles/service.*.log'
settings:
  monitoring:
    enabled: true
    use_output: default
    logs: true
    metrics: true

Hello - we're reviewing the issue in depth on our end and when fixed we can share the 7.9 build, I cannot provide any time estimate on that. Thank you for the patience and for asking! Best regards.

Great, thank you very much.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.