Elastic Agent with Synthetics Integration- Adding TCP monitor break the Agent

Elastic Stack Beats
,
1

Hi All,

I have an Elastic Agent Installed with synthetic integration (heartbeat). Adding HTTP and ICMP monitors work fine but when I tried adding a TCP monitor with the correct host:port format the agent become unhealthy and the log shows the following error.

Is there any bug or known issues for the TCP monitor?

15:31:14.621 elastic_agent [elastic_agent][error] Elastic Agent status changed to: 'error'
15:31:14.622 elastic_agent [elastic_agent][error] 2021-08-06T15:31:14+02:00 - message: Application: filebeat--7.14.0[bd9f0a02-8c71-46b2-bd05-b049b05c5913]: State changed to FAILED: 1 error occurred:
	* 1 error: Error creating runner from config: need to specify the host using the `host:port` syntax accessing config

 - type: 'ERROR' - sub_type: 'FAILED'

Thank you.

Regards,
Nugroho

2

Can you share the config that you used? Also can you share the heartbeat logs? You should find them under data/elastic-agent-*/....?

3

Hi @ruflin ,

The heartbeat does not have any error, the monitor works and I can see the result in Uptime app.

Only the Elastic Agent is unhealthy, performs multiple restart (Restart loop) and the filebeat-json.log contains the following error:

/opt/Elastic/Agent/data/elastic-agent-e127fc/logs/default/filebeat-json.log

{"log.level":"info","@timestamp":"2021-08-09T09:56:14.060Z","log.logger":"centralmgmt.fleet","log.origin":{"file.name":"management/manager.go","file.line":236},"message":"Applying settings for filebeat.modules","service.name":"filebeat","event.dataset":"filebeat-json.log","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2021-08-09T09:56:14.060Z","log.logger":"centralmgmt.fleet","log.origin":{"file.name":"management/manager.go","file.line":137},"message":"Status change to Failed: 1 error occurred:\n\t* 1 error: Error creating runner from config: need to specify the host using the `host:port` syntax accessing config\n\n","service.name":"filebeat","event.dataset":"filebeat-json.log","ecs.version":"1.6.0"}

12:01:40.553
elastic_agent
devops-test
[elastic_agent][error] 2021-08-09T10:01:40Z - message: Application: filebeat--7.14.0[9b863173-44e3-4e22-bf24-0e4b5d845521]: State changed to FAILED: 1 error occurred:
	* 1 error: Error creating runner from config: need to specify the host using the `host:port` syntax accessing config

 - type: 'ERROR' - sub_type: 'FAILED'
12:01:50.556
elastic_agent
devops-test
[elastic_agent][info] 2021-08-09T10:01:50Z - message: Application: filebeat--7.14.0[9b863173-44e3-4e22-bf24-0e4b5d845521]: State changed to RESTARTING:  - type: 'STATE' - sub_type: 'STARTING'

This issue does not happen for HTTP monitor.

4

Hi, sorry I missed that the errors logs come from filebeat. Any chance you could share the full policy (copy it from the Fleet UI in the yaml format)? It seems odd that filebeat is involved in this in the first place (assuming there are no filebeat inputs) so I assume something goes wrong there. I have one suspicion and will do some testing locally.

5

I can also reproduce this locally. I'm suspecting that something with the routing of the synthetics/tcp input type goes wrong.

6

I filed [Elastic Agent] Adding synthetics/tcp input does not work · Issue #27277 · elastic/beats · GitHub so we can follow up and track it.

7

Thank you @ruflin. I will follow the Github issue.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.