Elastic-Agent not providing data-stream

Elastic Security
,
1

I have a docker with xpac enabled. I documented what I did here:
https://github.com/cwobuzz/Setting-up-Docker-Elastic-Kibana-Running-Sysmon-And-Agent/blob/master/.README.md

I have agent successfully installed. However it will not send data into my elasticsearch. Fleet shows not data. I cannot find any documents on your site on how to fix this.

My command to install the agent is this

PS C:\Program Files\Elastic-Agent> .\elastic-agent.exe install -f --kibana-url=https://localhost:5601 --enrollment-token=bHRPdUlIWUJSMzJvZjZwSktjbzQ6QUY0SmpvNFZSY1MxMUZCSk82S3ZRQQ== -a \\wsl$\docker-desktop-data\version-pack-data\community\docker\volumes\es_certs\_data\ca\ca.crt -i

It returns successful.

My only clue of what could be happening is this:

{"log.level":"debug","@timestamp":"2020-12-22T15:18:54.462-0700","log.logger":"esclientleg","log.origin":{"file.name":"eslegclient/connection.go","file.line":290},"message":"ES Ping(url=https://localhost:9200)","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2020-12-22T15:18:54.476-0700","log.logger":"esclientleg","log.origin":{"file.name":"eslegclient/connection.go","file.line":294},"message":"Ping request failed with: Get \"https://localhost:9200\": x509: certificate signed by unknown authority","ecs.version":"1.6.0"}

##Please help :slight_smile:

2

My guess you are hitting a certificate issue. Can you check the following posts if they provide you with a workaround? https://discuss.elastic.co/search?q=authority%20tag%3Aelastic-agent We are working on improving the situation.

3

Just for others who stumble across this page, I doubt that the intention is to install the agent on the same instance as Kibana + ES , as shown by the localhost enries in the logs above.

In kibana anywhere under the fleet menu you will have settings in the top right. Make sure you set the Kibana and Elasticsearch URLs appropriatly for your set-up.

4

Hi, I had the same issue, but not in docker.
It stems from the fact that the workstation agent (as of 7.11.2) igniores the local trusted root certificate store and wants a hard coded path to the ca certificate.

You can see the solution here: https://discuss.elastic.co/t/elastic-agent-healthy-but-no-data-streams/265699

I'd like to post this as a bug - where should I do that?