Elastic Agent not sending data to ES through proxy (Windows)

Elastic Security
1

Hi all,

Sorry if this has been asked before, but I am pretty much baffled now and can't get this working.

Version: 1.17.1
Fleet Managed Agents.

Problem: Elastic agents aren't sending data through the proxy to Elasticsearch.

Steps taken so far:

1st - I added "--proxy-url=http://domain:port" to my powershell script, as well as a powershell proxy profile - everything runs fine, it downloads and registers the agent as I can see it in Fleet Agents....

2nd) I checked fleet.yml and can see this added the proxy URL to the .yml config, still nothing

3rd) I tried adding proxy environment variables:

Set-ItemProperty "HKLM:SYSTEM\CurrentControlSet\Services\Elastic Agent" -Name Environment -Value http://internal-proxy-nlb.vpc7.restofdomain.com:3128

Restart-Service "Elastic Agent" - yep still nothing....

4th) Tried adding the proxy url to the elastic-agent.yml file - but I think this may be incorrect due to it being fleet managed.

I can see bits and bats hitting the proxy when restarting the agent or installing it, etc. but when I try force some data through to elastic, just nothing, not even attempting to hit the Proxy at all.

The only thing I haven't tried is adding the proxy url to the output in "Elasticsearch output configuration (YML)" under fleet settings, is this where I am suppose to set the proxy up?

And if so, is there anyway to add to HTTP urls as these agents go to AWS instances in different regions which have there own proxies with the ability to add more Proxy URLs in future?

Cheers,

James

2

Hi all, sorry to bump but I still haven't figured this out.

Anyone else come across this before? would it be recommended to open an issue in github instead?

3

Have you also added the proxy to the Elasticsearch output in Fleet? The UI to do that seems to have changed a little across versions, but as of 8.2, go to Management->Fleet then select the Settings tab. In the table, pick the output configuration you wish to change, then click the edit icon. You should be able to add the configuration under the "Advanced YAML configuration" section.

The below snippet ought to work, you can confirm it looks good either by seeing it work in action, looking at Agent logs (I think), or by going to the "Agent policies" tab and selecting "View policy" from the actions column for the right Agent policy, which will show you the full YAML configuration for the Agent policy.

output:
  elasticsearch:
    proxy_url: "your setting"

Hopefully that helps.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.