Elastic agent does not send logs

john12 · August 18, 2021, 9:57am

Hello,

i have problem that i do not receiving logs by elastic agents managed by a fleet.
fleet server working fine, and agents connected to fleet server
status is "Healthy"
i tried different machines, and i had enabled different integrations but problem not solved

what i have missed?

thank u

vivo12 · August 19, 2021, 9:07am

i have exactly the same problem

john12 · August 19, 2021, 9:19am

everything done correctly with me even port is opened,
but no index created, and no logs got,
but when i tried to install a standalone elastic-agent it worked and given results

ruflin · August 20, 2021, 7:03am

Can you both share what versions you are using? Can you share the logs of your Elastic Agent?

rstasiunas · August 20, 2021, 6:36pm

Are your ES nodes configured for TLS? If so, you need to specify the CA cert (which should be different from the Fleet cert) in the additional YAML settings for the ES connection.

Some_Dank · August 25, 2021, 10:59am

Hello! First post here, because I'm also looking for solution here.
I have fresh EC2 instance, I'm using Elastic Cloud, so i downloaded TAR of Elastic-Agent, sudo install with enrollment token flag, that comes within Fleet, when Adding Agent. So Agent is enrolled successfully, it is shown as HEALTHY, policy assigned - Default, also tried to create new one, with just systemd / procinfo, but when going to Logs tab, no data is there, I see that there is Datasets - agent, filebeat, metricsbeat & security, but - There are no log messages to display.
When checking logs of metricsbeat, i see that it is collecting CPU info etc, but it is not being sent to EC, although i see logged SSH sessions there via EC, very weird... Please assist.
Log file of elastic agent

2021-08-25T10:48:50.082Z        INFO    operation/operator.go:259       operation 'operation-install' skipped for metricbeat.7.14.0
2021-08-25T10:48:50.082Z        INFO    operation/operator.go:259       operation 'operation-start' skipped for metricbeat.7.14.0
2021-08-25T10:48:50.082Z        DEBUG   operation/operator.go:263       running operation 'operation-config' for metricbeat.7.14.0
2021-08-25T10:48:50.084Z        INFO    process/configure.go:50 initiating restart of 'metricbeat' due to config change
2021-08-25T10:48:50.089Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.089Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.089Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.089Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.089Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.089Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.089Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.089Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.089Z        INFO    log/reporter.go:40      2021-08-25T10:48:50Z - message: Application: filebeat--7.14.0[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'
2021-08-25T10:48:50.584Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.585Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.585Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.585Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.585Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.585Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.585Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.585Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.589Z        INFO    log/reporter.go:40      2021-08-25T10:48:50Z - message: Application: metricbeat--7.14.0--36643631373035623733363936343635[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.949Z        INFO    log/reporter.go:40      2021-08-25T10:48:50Z - message: Application: metricbeat--7.14.0--36643631373035623733363936343635[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.949Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.949Z        INFO    stateresolver/stateresolver.go:66  Updating internal state
2021-08-25T10:48:50.949Z        DEBUG   lazy/lazy_acker.go:41   appending action with id 'policy:018fa470-057b-11ec-b8cc-4f4fd2f2b67c:9:1' to the queue
2021-08-25T10:48:50.954Z        DEBUG   store/state_store.go:273        save state on disk : {action:0xc000290540 ackToken:344181b3-173a-49bb-a206-e2940a0f955d}
2021-08-25T10:48:50.954Z        DEBUG   dispatcher/dispatcher.go:98     Successfully dispatched action: 'action_id: policy:018fa470-057b-11ec-b8cc-4f4fd2f2b67c:9:1, type: POLICY_CHANGE'
2021-08-25T10:48:50.954Z        DEBUG   fleet/fleet_acker.go:92 1 actions with ids 'policy:018fa470-057b-11ec-b8cc-4f4fd2f2b67c:9:1' acknowledging
2021-08-25T10:48:50.954Z        DEBUG   remote/client.go:169    Request method: POST, path: /api/fleet/agents/59a25501-d218-48ea-b2a6-5f64c0373fc5/acks
2021-08-25T10:48:50.971Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:48:50.971Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:50.971Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:50.971Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:50.971Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:50.971Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:50.971Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:50.971Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:50.971Z        INFO    log/reporter.go:40      2021-08-25T10:48:50Z - message: Application: filebeat--7.14.0--36643631373035623733363936343635[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'
2021-08-25T10:48:51.353Z        DEBUG   fleet/fleet_gateway.go:184      FleetGateway is sleeping, next update in 1s
2021-08-25T10:48:51.353Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:51.353Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:48:51.353Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:51.353Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:51.353Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:51.353Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:51.353Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:51.353Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:52.144Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:48:52.144Z        INFO    log/reporter.go:40      2021-08-25T10:48:52Z - message: Application: metricbeat--7.14.0--36643631373035623733363936343635[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'
2021-08-25T10:48:52.144Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:48:52.144Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:48:52.144Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:48:52.144Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:48:52.144Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:48:52.144Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:48:52.144Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:48:52.564Z        DEBUG   fleet/fleet_gateway.go:160      FleetGateway calling Checkin API
2021-08-25T10:48:52.564Z        DEBUG   fleet/fleet_gateway.go:202      Checking started
2021-08-25T10:48:52.666Z        DEBUG   fleet/fleet_gateway.go:233      using previously saved ack token: 344181b3-173a-49bb-a206-e2940a0f955d
2021-08-25T10:48:52.666Z        DEBUG   remote/client.go:169    Request method: POST, path: /api/fleet/agents/59a25501-d218-48ea-b2a6-5f64c0373fc5/checkin
2021-08-25T10:49:09.807Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:49:09.807Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:49:09.807Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:49:09.807Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:49:09.807Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:49:09.807Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'
2021-08-25T10:49:09.807Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0--36643631373035623733363936343635-911deba6' has status 'online'
2021-08-25T10:49:09.807Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:49:09.810Z        INFO    log/reporter.go:40      2021-08-25T10:49:09Z - message: Application: endpoint-security--7.14.0[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to CONFIG:  - type: 'STATE' - sub_type: 'CONFIG'
2021-08-25T10:49:16.372Z        DEBUG   status/reporter.go:200  'gateway-ae89d55d' has status 'online'
2021-08-25T10:49:16.372Z        DEBUG   status/reporter.go:200  'capabilities-ae7b11db' has status 'online'
2021-08-25T10:49:16.372Z        DEBUG   status/reporter.go:200  'operator-default-ae174253' has status 'online'
2021-08-25T10:49:16.372Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0--36643631373035623733363936343635-3af6bd7c' has status 'online'
2021-08-25T10:49:16.372Z        DEBUG   status/reporter.go:212  'endpoint-security--7.14.0-c7339cd4' has status 'online'
2021-08-25T10:49:16.372Z        INFO    log/reporter.go:40      2021-08-25T10:49:16Z - message: Application: endpoint-security--7.14.0[59a25501-d218-48ea-b2a6-5f64c0373fc5]: State changed to RUNNING: Protecting with policy {e3704a26-b1f6-42c1-b352-9bd7f8fd06f1} - type: 'STATE' - sub_type: 'RUNNING'
2021-08-25T10:49:16.372Z        DEBUG   status/reporter.go:212  'metricbeat--7.14.0-3abfdd7b' has status 'online'
2021-08-25T10:49:16.372Z        DEBUG   status/reporter.go:212  'filebeat--7.14.0-c1505a31' has status 'online'

although i can output data on dashboard

john12 · August 31, 2021, 9:30am

This solve the issue , Thanx

john12 · August 31, 2021, 9:31am

Thanx , this solve the issue

system · September 28, 2021, 9:32am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.