everything done correctly with me even port is opened,
but no index created, and no logs got,
but when i tried to install a standalone elastic-agent it worked and given results
Are your ES nodes configured for TLS? If so, you need to specify the CA cert (which should be different from the Fleet cert) in the additional YAML settings for the ES connection.
Hello! First post here, because I'm also looking for solution here.
I have fresh EC2 instance, I'm using Elastic Cloud, so i downloaded TAR of Elastic-Agent, sudo install with enrollment token flag, that comes within Fleet, when Adding Agent. So Agent is enrolled successfully, it is shown as HEALTHY, policy assigned - Default, also tried to create new one, with just systemd / procinfo, but when going to Logs tab, no data is there, I see that there is Datasets - agent, filebeat, metricsbeat & security, but - There are no log messages to display.
When checking logs of metricsbeat, i see that it is collecting CPU info etc, but it is not being sent to EC, although i see logged SSH sessions there via EC, very weird... Please assist.
Log file of elastic agent
2021-08-25T10:48:50.082Z INFO operation/operator.go:259 operation 'operation-install' skipped for metricbeat.7.14.0
2021-08-25T10:48:50.082Z INFO operation/operator.go:259 operation 'operation-start' skipped for metricbeat.7.14.0
2021-08-25T10:48:50.082Z DEBUG operation/operator.go:263 running operation 'operation-config' for metricbeat.7.14.0
2021-08-25T10:48:50.084Z INFO process/configure.go:50 initiating restart of 'metricbeat' due to config change
2021-08-25T10:48:50.089Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.089Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.089Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.089Z DEBUG status/reporter.go:212 'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.089Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.089Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.089Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.089Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.089Z INFO log/reporter.go:40 2021-08-25T10:48:50Z - message: Application: filebeat--7.14.0[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'
2021-08-25T10:48:50.584Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.585Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.585Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.585Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.585Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.585Z DEBUG status/reporter.go:212 'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.585Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.585Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.589Z INFO log/reporter.go:40 2021-08-25T10:48:50Z - message: Application: metricbeat--7.14.0--36643631373035623733363936343635[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.949Z INFO log/reporter.go:40 2021-08-25T10:48:50Z - message: Application: metricbeat--7.14.0--36643631373035623733363936343635[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.949Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.949Z INFO stateresolver/stateresolver.go:66 Updating internal state
2021-08-25T10:48:50.949Z DEBUG lazy/lazy_acker.go:41 appending action with id 'policy:018fa470-057b-11ec-b8cc-4f4fd2f2b67c:9:1' to the queue
2021-08-25T10:48:50.954Z DEBUG store/state_store.go:273 save state on disk : {action:0xc000290540 ackToken:344181b3-173a-49bb-a206-e2940a0f955d}
2021-08-25T10:48:50.954Z DEBUG dispatcher/dispatcher.go:98 Successfully dispatched action: 'action_id: policy:018fa470-057b-11ec-b8cc-4f4fd2f2b67c:9:1, type: POLICY_CHANGE'
2021-08-25T10:48:50.954Z DEBUG fleet/fleet_acker.go:92 1 actions with ids 'policy:018fa470-057b-11ec-b8cc-4f4fd2f2b67c:9:1' acknowledging
2021-08-25T10:48:50.954Z DEBUG remote/client.go:169 Request method: POST, path: /api/fleet/agents/59a25501-d218-48ea-b2a6-5f64c0373fc5/acks
2021-08-25T10:48:50.971Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.971Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.971Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.971Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.971Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.971Z DEBUG status/reporter.go:212 'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.971Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.971Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.971Z INFO log/reporter.go:40 2021-08-25T10:48:50Z - message: Application: filebeat--7.14.0--36643631373035623733363936343635[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'
2021-08-25T10:48:51.353Z DEBUG fleet/fleet_gateway.go:184 FleetGateway is sleeping, next update in 1s
2021-08-25T10:48:51.353Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:51.353Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:48:51.353Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:51.353Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:51.353Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:51.353Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:51.353Z DEBUG status/reporter.go:212 'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:51.353Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:52.144Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:52.144Z INFO log/reporter.go:40 2021-08-25T10:48:52Z - message: Application: metricbeat--7.14.0--36643631373035623733363936343635[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'
2021-08-25T10:48:52.144Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:48:52.144Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:52.144Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:52.144Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:52.144Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:52.144Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:52.144Z DEBUG status/reporter.go:212 'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:52.564Z DEBUG fleet/fleet_gateway.go:160 FleetGateway calling Checkin API
2021-08-25T10:48:52.564Z DEBUG fleet/fleet_gateway.go:202 Checking started
2021-08-25T10:48:52.666Z DEBUG fleet/fleet_gateway.go:233 using previously saved ack token: 344181b3-173a-49bb-a206-e2940a0f955d
2021-08-25T10:48:52.666Z DEBUG remote/client.go:169 Request method: POST, path: /api/fleet/agents/59a25501-d218-48ea-b2a6-5f64c0373fc5/checkin
2021-08-25T10:49:09.807Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:49:09.807Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:49:09.807Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:49:09.807Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:49:09.807Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:49:09.807Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:49:09.807Z DEBUG status/reporter.go:212 'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:49:09.807Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:49:09.810Z INFO log/reporter.go:40 2021-08-25T10:49:09Z - message: Application: endpoint-security--7.14.0[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to CONFIG: - type: 'STATE' - sub_type: 'CONFIG'
2021-08-25T10:49:16.372Z DEBUG status/reporter.go:200 'gateway-ae89d55d' has status 'online'
2021-08-25T10:49:16.372Z DEBUG status/reporter.go:200 'capabilities-ae7b11db' has status 'online'
2021-08-25T10:49:16.372Z DEBUG status/reporter.go:200 'operator-default-ae174253' has status 'online'
2021-08-25T10:49:16.372Z DEBUG status/reporter.go:212 'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:49:16.372Z DEBUG status/reporter.go:212 'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:49:16.372Z INFO log/reporter.go:40 2021-08-25T10:49:16Z - message: Application: endpoint-security--7.14.0[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to RUNNING: Protecting with policy {e3704a26-b1f6-42c1-b352-9bd7f8fd06f1} - type: 'STATE' - sub_type: 'RUNNING'
2021-08-25T10:49:16.372Z DEBUG status/reporter.go:212 'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:49:16.372Z DEBUG status/reporter.go:212 'filebeat--7.14.0-c1505a31' has status 'online'
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.