Elastic agent: "output not supported" using Logstash output on 8.6

[ceekay]

Hi all,

I have a previously working^* Fleet/Agent config with 8.5.3 and Logstash output configured.

^{* aside from 8.5.1 agents go unhealthy · Issue #1790 · elastic/elastic-agent · GitHub but I have a workaround for this.}

When upgraded to 8.6.x, agents will fail to connect to the Logstash output and appear offline in the Fleet Agent interface.

I don't see anything of note in the logs other than various beats reporting in, however elastic-agent status shows output not supported for an unnamed component.

# elastic-agent version
Binary: 8.6.2 (build: 913c02bea9b13dec4d5c5f3057b5b397344e3298 at 2023-02-13 16:51:45 +0000 UTC)
Daemon: 8.6.2 (build: 913c02bea9b13dec4d5c5f3057b5b397344e3298 at 2023-02-13 16:51:45 +0000 UTC)

# elastic-agent status
State: DEGRADED
Message: 1 or more components/units in a failed state
Components:
  * beat/metrics    (HEALTHY)
                    Healthy: communicating with pid '80217'
  * log             (HEALTHY)
                    Healthy: communicating with pid '80185'
  * system/metrics  (HEALTHY)
                    Healthy: communicating with pid '80192'
  *                 (FAILED)
                    output not supported
  * http/metrics    (HEALTHY)
                    Healthy: communicating with pid '80201'
  * filestream      (HEALTHY)
                    Healthy: communicating with pid '80208'

Logstash, Elasticsearch and Kibana are all 8.6.2.

Switching back to Elasticsearch output and things appear fine however, this is not a solution for me as ES is only directly reachable by a subset of my agents.

Any ideas or should I open an issue? It's 100% unusable in this state as all agents go offline, and I've had to downgrade the agents to 8.5.3 just to get going again.

[ceekay]

FYI this seems to be the issue: [Fleet] Prevent output changing types from Elasticsearch -> Logstash if a Fleet Server policy uses it · Issue #152234 · elastic/kibana · GitHub