# Elastic-Agent enrollment problem

**URL:** <https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426>\
**Category:** Elasticsearch\
**Tags:** elastic-agent\
**Created:** [August 26, 2020, 9:43am UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426 "2020-08-26T09:43:10Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![bernhard.fluehmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bernhard.fluehmann/32/71755_2.png) [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\
**Post date:** [August 26, 2020, 9:43am UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/1 "2020-08-26T09:43:11Z")

</div>

I am trying to test elastic-agent and ingest-mangement, unfortunately without success so far.

The agent is installed on linux machines (centos-7/8) and enrolled like described in the manuals.  
The agents show up in kibana as online.

But they do not send data. It seems that event when the agents are registered at kibana they did not get the right config, or no config at all.

Please let me know what may be the problem or what I am missing or doing wrong.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 26, 2020, 10:37am UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/2 "2020-08-26T10:37:40Z")

</div>

Hoi @bernhard.fluehmann Glad to see you are trying out Ingest Manager + Agent. I assume you are using all 7.9 components?

If you click on an Agent, you see an event log on what happened. Do you see something suspicous there?

What did you configure as the Elasticsearch output url? Can you access it from the agent?

One way to debug is checking out the `data` directory and in there (nested) you will find some logs. Especially the metricbeat logs should contain some info around failed to publish events.

---

<div class="post-metadata">

**Author:** ![bernhard.fluehmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bernhard.fluehmann/32/71755_2.png) [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\
**Post date:** [August 26, 2020, 11:11am UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/3 "2020-08-26T11:11:03Z")

</div>

Hoi @ruflin,

Thank your for your fast answer.

Yes, everything is 7.9.0 and agent packages are .rpm

Event log seems good to me. Some starting events, a config change action and some beats running.

I had another look at the config file on kibana, where I see that elastic output is localhost.

As with 7.8 I have configured the output in kibana.yml with the following commands:  
xpack.ingestManager.fleet.kibana.host: elastic01-t-bfl.intra.realstuff:5601  
xpack.ingestManager.fleet.elasticsearch.host: elastic01-t-bfl.intra.realstuff.ch:5601

Do I have to configure it somewhere else or with different parameters?

The logs are showing the obvious, no connection to localhost possible

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 26, 2020, 11:23am UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/4 "2020-08-26T11:23:41Z")

</div>

In the UI / API you can go to Settings in the Ingest Manager and adjust the ES host url there. Can you check what is in there?

---

<div class="post-metadata">

**Author:** ![bernhard.fluehmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bernhard.fluehmann/32/71755_2.png) [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\
**Post date:** [August 26, 2020, 11:51am UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/5 "2020-08-26T11:51:15Z")

</div>

That was exactly the problem. After adjusting that setting the configuration in kibana was correct.  
The only strange thing was that even the agents connected repeatedly to kibana, they did not grab the modified config.

After an uninstall and fresh agent install and enroll everything works now.

Does this mean the xpack.ingestManager settings introduced in 7.8. have no effect anymore?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 27, 2020, 12:17pm UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/6 "2020-08-27T12:17:19Z")

</div>

In [https://github.com/elastic/kibana/issues/72731](https://github.com/elastic/kibana/issues/72731) we had quite a bit of discussion (second part) around the behaviour on this. What you have seen I would also say is not expected. The part that worries me is that you adjusted it in the UI and it didn't get populated, this sounds like a bug ☹

---

<div class="post-metadata">

**Author:** ![bernhard.fluehmann](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bernhard.fluehmann/32/71755_2.png) [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\
**Post date:** [August 27, 2020, 1:12pm UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/7 "2020-08-27T13:12:41Z")

</div>

First of all it wold be very helpful for others if the required configuration step would appear in the manual. As far as I can see it is not mentioned anywhere. So for the moment it is working fine and the setting is only needed at the beginning.

But one potential problem I can see is when it comes to cluster changes in the future. I.e. when nodes are added to or removed from the cluster. This may not happen in cloud scenarios or when data is shipped thru reverse proxies or load balancers, but many customers use direct connections to multiple elastic nodes.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [August 31, 2020, 12:24pm UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/8 "2020-08-31T12:24:18Z")

</div>

Mentioning @dedemorton for the docs part.

On the Kibana side, you might be interested in this PR here: [https://github.com/elastic/kibana/pull/75712](https://github.com/elastic/kibana/pull/75712) We are on the same page 😉

---

<div class="post-metadata">

**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\
**Post date:** [August 31, 2020, 6:17pm UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/9 "2020-08-31T18:17:49Z")

</div>

Thanks for the mention. Fixing this is on my to-do list for today. I've opened an issue so you can track the work: [https://github.com/elastic/observability-docs/issues/121](https://github.com/elastic/observability-docs/issues/121)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2020, 6:17pm UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426/10 "2020-09-28T18:17:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
