Elastic agents are not sending data to fleet server

Elastic Stack Elasticsearch
1

Hello everyone!

I set up a Fleet Server in CentOS with the command

sudo ./elastic-agent install \
  --fleet-server-es=http://<host-ip>:9200 \
  --fleet-server-service-token=<token> \
  --fleet-server-policy=<policy-id) --fleet-server-insecure-http

In my fleet policy configuration host is 0.0.0.0 and port is the default, 8220.

When I run the command I can get the fleet in Healthy status. But, when I try to enroll a agent on that it does not work. The agent is enrolled but does not send any data. Follow a command that I used to enroll an agent:

sudo ./elastic-agent install --url=http://<fleet-host-ip>:8220 --enrollment-token=<token> --insecure

Can somebody help me to solve that?

1 Like
2

Hi,
Sorry, I don't have the solution, but I'm in the exact same situation.

Elastic Agents can enroll and obtain a Healthy status in the Fleet section of Kibana.
I can see on my agents that the sub process filebeat and metricbeat aren't able to send logs to the elastic server because of this line in the file "C:\Program Files\Elastic\Agent\data\elastic-agent-d3eb3e\logs\default\filebeat-20220930-26.ndjson" :

{"log.level":"error","@timestamp":"2022-09-30T23:14:08.288+0200","log.logger":"esclientleg","log.origin":{"file.name":"transport/logging.go","file.line":38},"message":"Error dialing x509: certificate signed by unknown authority","service.name":"filebeat","network":"tcp","address":"192.168.0.156:9200","ecs.version":"1.6.0"}

My agents were enrolled with this command line :

PS C:\Program Files\Elastic\Agent> .\elastic-agent.exe enroll --url=https://srv-fleet.xxxxxxxxx.xxx:8220 --enrollment-token=TVpveWpvTxxxxxxxxxxxxxxxxxxxxxxxxxxxxx0daazlyUUVXM1ZVQQ== --ca-sha256 f8dadxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx4f53e002f60d --certificate-authorities "C:\Program Files\Elastic\Agent\srv-fleet.crt" --insecure

My fleet server and my elastic stack are not on the same server.

So I might create a separate topic for my own problem, but before I do, I'll let people try to solve Leonardo's problem because I think it might solve mine too.

3

Thank you for sharing your issue as well.

This is not an solution, but more like a workaround.

For some reason installing fleet server and apm throught binaries (with yum in my case) was not working. I installed the first one in server A and the other in server B. The connections between the two hosts were ok, but nothing worked.

Then I decided to deploy fleet and agent as docker containers and I could get it running, but I know that it is not a fit solution for every case. So, if someone that faced the issue described above could give us some guidance, it woud be great.

Thanks!

1 Like
4

Have you found the solution for this.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.