I am trying to test elastic-agent and ingest-mangement, unfortunately without success so far.
The agent is installed on linux machines (centos-7/8) and enrolled like described in the manuals.
The agents show up in kibana as online.
But they do not send data. It seems that event when the agents are registered at kibana they did not get the right config, or no config at all.
Please let me know what may be the problem or what I am missing or doing wrong.
Hoi @bernhard.fluehmann Glad to see you are trying out Ingest Manager + Agent. I assume you are using all 7.9 components?
If you click on an Agent, you see an event log on what happened. Do you see something suspicous there?
What did you configure as the Elasticsearch output url? Can you access it from the agent?
One way to debug is checking out the data directory and in there (nested) you will find some logs. Especially the metricbeat logs should contain some info around failed to publish events.
Hoi @ruflin,
Thank your for your fast answer.
Yes, everything is 7.9.0 and agent packages are .rpm
Event log seems good to me. Some starting events, a config change action and some beats running.
I had another look at the config file on kibana, where I see that elastic output is localhost.
As with 7.8 I have configured the output in kibana.yml with the following commands:
xpack.ingestManager.fleet.kibana.host: elastic01-t-bfl.intra.realstuff:5601
xpack.ingestManager.fleet.elasticsearch.host: elastic01-t-bfl.intra.realstuff.ch:5601
Do I have to configure it somewhere else or with different parameters?
The logs are showing the obvious, no connection to localhost possible
In the UI / API you can go to Settings in the Ingest Manager and adjust the ES host url there. Can you check what is in there?
That was exactly the problem. After adjusting that setting the configuration in kibana was correct.
The only strange thing was that even the agents connected repeatedly to kibana, they did not grab the modified config.
After an uninstall and fresh agent install and enroll everything works now.
Does this mean the xpack.ingestManager settings introduced in 7.8. have no effect anymore?
In https://github.com/elastic/kibana/issues/72731 we had quite a bit of discussion (second part) around the behaviour on this. What you have seen I would also say is not expected. The part that worries me is that you adjusted it in the UI and it didn't get populated, this sounds like a bug 
First of all it wold be very helpful for others if the required configuration step would appear in the manual. As far as I can see it is not mentioned anywhere. So for the moment it is working fine and the setting is only needed at the beginning.
But one potential problem I can see is when it comes to cluster changes in the future. I.e. when nodes are added to or removed from the cluster. This may not happen in cloud scenarios or when data is shipped thru reverse proxies or load balancers, but many customers use direct connections to multiple elastic nodes.
Mentioning @dedemorton for the docs part.
On the Kibana side, you might be interested in this PR here: https://github.com/elastic/kibana/pull/75712 We are on the same page 
Thanks for the mention. Fixing this is on my to-do list for today. I've opened an issue so you can track the work: https://github.com/elastic/observability-docs/issues/121
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.