Hi @laale1
This error means that Endpoint is not able to connect to Elasticsearch. The two most likely causes are a networking issue (like a firewall) blocking the connection or an SSL configuration error.
To diagnose it, I recommend turning on debug logging (click on Logs in the screenshot you shared, then change the "Agent logging level" at the bottom on screen to "Debug" and click "Apply changes"). In a few moments you should see Endpoint start emitting debug logs (which contain {... "log": {"level":"debug"...} ...} in them).
To check Endpoint logs open an Administrator cmd.exe window and open the highest numbered file in c:\Program Files\Elastic\Endpoint\state\log\ (e.g. endpoint-000000.log). In the logs you should see messages like what's below every time Endpoint tries to connect to Elasticsearch just before the log Elasticsearch connection is down.
In my example below the problem was that Elasticseach was not running on localhost:1443. You'll see different logs depending on what the problem is. If from reading them you still aren't sure what the problem is, just share sanitized logs here.
{"@timestamp":"2023-08-17T20:28:19.58268557Z","agent":{"id":"0268482d-8fec-411b-b97e-9d6556b40238","type":"endpoint"},"ecs":{"version":"1.11.0"},"log":{"level":"debug","origin":{"file":{"line":672,"name":"HttpLib.cpp"}}},"message":"HttpLib.cpp:672 Making HTTP request without a proxy","process":{"pid":39871,"thread":{"id":39884}}}
{"@timestamp":"2023-08-17T20:28:19.585224682Z","agent":{"id":"0268482d-8fec-411b-b97e-9d6556b40238","type":"endpoint"},"ecs":{"version":"1.11.0"},"log":{"level":"debug","origin":{"file":{"line":859,"name":"HttpLib.cpp"}}},"message":"HttpLib.cpp:859 Adding 274 CA certificates","process":{"pid":39871,"thread":{"id":39884}}}
{"@timestamp":"2023-08-17T20:28:19.585261548Z","agent":{"id":"0268482d-8fec-411b-b97e-9d6556b40238","type":"endpoint"},"ecs":{"version":"1.11.0"},"log":{"level":"debug","origin":{"file":{"line":897,"name":"HttpLib.cpp"}}},"message":"HttpLib.cpp:897 Removing SNI from no connection? https://localhost:1443/","process":{"pid":39871,"thread":{"id":39884}}}
{"@timestamp":"2023-08-17T20:28:19.585274454Z","agent":{"id":"0268482d-8fec-411b-b97e-9d6556b40238","type":"endpoint"},"ecs":{"version":"1.11.0"},"log":{"level":"debug","origin":{"file":{"line":1026,"name":"HttpLib.cpp"}}},"message":"HttpLib.cpp:1026 Establishing GET connection to [https://localhost:1443/]","process":{"pid":39871,"thread":{"id":39884}}}
{"@timestamp":"2023-08-17T20:28:19.932462326Z","agent":{"id":"0268482d-8fec-411b-b97e-9d6556b40238","type":"endpoint"},"ecs":{"version":"1.11.0"},"log":{"level":"debug","origin":{"file":{"line":322,"name":"Http.cpp"}}},"message":"Http.cpp:322 CURL error 0: No error","process":{"pid":39871,"thread":{"id":39884}}}
{"@timestamp":"2023-08-17T20:28:19.932483463Z","agent":{"id":"0268482d-8fec-411b-b97e-9d6556b40238","type":"endpoint"},"ecs":{"version":"1.11.0"},"log":{"level":"debug","origin":{"file":{"line":334,"name":"Http.cpp"}}},"message":"Http.cpp:334 HTTP code 404: Not Found","process":{"pid":39871,"thread":{"id":39884}}}
{"@timestamp":"2023-08-17T20:28:19.932579839Z","agent":{"id":"0268482d-8fec-411b-b97e-9d6556b40238","type":"endpoint"},"ecs":{"version":"1.11.0"},"log":{"level":"error","origin":{"file":{"line":244,"name":"ElasticsearchClient.cpp"}}},"message":"ElasticsearchClient.cpp:244 HTTP Status Code (404): {\"message\":\"Unknown resource.\",\"ok\":false}","process":{"pid":39871,"thread":{"id":39884}}}
{"@timestamp":"2023-08-17T20:28:19.932604527Z","agent":{"id":"0268482d-8fec-411b-b97e-9d6556b40238","type":"endpoint"},"ecs":{"version":"1.11.0"},"log":{"level":"notice","origin":{"file":{"line":93,"name":"BulkQueueConsumer.cpp"}}},"message":"BulkQueueConsumer.cpp:93 Elasticsearch connection is down","process":{"pid":39871,"thread":{"id":39884}}}
