Elastic agent tries to download beats from Elastic artifacts directly without passing by fleet server

Elastic Stack Kibana
1

I installed fleet server & kibana in a machine that has access to internet and installed elasticagent in Windows server that does not have access to internet. But when I try to add integration (osquerybeat) i find in the logs that elasticagent tries to connect to elastic artifacts directly without passing by fleet or kibana.

Version i installed
Elasticsearch, kibana, fleet & elasticagent all in 7.15.1

Is that a bug! Cause i can see also an open issue in the github

2

Air gapped networks are not supported yet in Fleet Beats and Elastic Agent capabilities | Fleet and Elastic Agent Guide [7.15] | Elastic. We have an open issue to change the URL for the artifact repo here [Fleet] Ability to configure agent.download.sourceURI in Kibana · Issue #100413 · elastic/kibana · GitHub. This will allow you to host an on-prem repo. Would that be a sufficient solution once its available?

Your suggestion of going through Kibana won't work in environments where the agents don't have access to Kibana. The agents do have access to Fleet Server, but sometimes Fleet Server also runs in an air gapped network. Is that the case for you as well?

3

Is this workaround works for Fleet-managed elasticagents?

If yes, which kibana parameter do i must change to allow elasticagents to download from local repository?

1 Like
4

This feature is not supported yet in 7.15. The issue I linked is a future enhancement we are considering for a later release.

5

Many thanks for your support and your reactivity
Regards.

6

Thank you.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.