Error on fleet-server install

Elastic Stack Elasticsearch
1

hi there,
I'm trying to install fleet-server on a VM with CentOS 7.
In this same VM I already have elasticsearch (8.9.0), logstash and kibana (version 8.6.1) installed.

To install I am using the commands below (advanced mode)

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.9.0-linux-x86_64.tar.gz
tar xzvf elastic-agent-8.9.0-linux-x86_64.tar.gz
cd elastic-agent-8.9.0-linux-x86_64
sudo ./elastic-agent install --url=https://my_url.com:8220 \
  --fleet-server-es=https://my_url.com:9200 \
  --fleet-server-service-token=XXXXXXXXXXXXXXXXXXXXXXXXXXXXX \
  --fleet-server-policy=2c3db780-5244-11ee-b17f-317560648b1c \
  --certificate-authorities=/etc/certs/ca.crt \
  --fleet-server-es-ca=/etc/certs/ca.crt \
  --fleet-server-cert=/etc/certs/fleet.crt \
  --fleet-server-cert-key=/etc/certs/fleet.key

also tried with --fleet-server-es-insecure flag

also tried with the command bellow

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.9.0-x86_64.rpm
sudo rpm -vi elastic-agent-8.9.0-x86_64.rpm
sudo elastic-agent enroll --url=https://apm.webmaissistemas.com.br:8220 \
  --fleet-server-es=https://my_urlr:9200 \
  --fleet-server-service-token=XXXXXXXXXXXXXXXXXXXXXXXXXX \
  --fleet-server-policy=2c3db780-5244-11ee-b17f-317560648b1c \
  --certificate-authorities=/etc/certs/ca.crt \
  --fleet-server-es-ca=/etc/certs/ca.crt \
  --fleet-server-cert=/etc/certs/fleet.crt \
  --fleet-server-cert-key=/etc/certs/fleet.key \
  --fleet-server-port=8220
sudo systemctl enable elastic-agent
sudo systemctl start elastic-agent

also tried with --fleet-server-es-insecure flag

in the Kibana interface I configured the fleet output and fleet server hosts like the image below

image
image639×834 34.7 KB

image
image660×633 38 KB

on both installations I get errors

Error: enroll command failed with exit code: 1
Error: fleet-server failed: context canceled

if need full log, how to enable it?

thanks

2

Hello!

elasticsearch (8.9.0), logstash and kibana (version 8.6.1)

This doesn't sound right, elasticsearch and kibana has to be on the same minor version, I think.

Is there any more output of the enroll command?

3

Hello,

I will try to update kibana version, but, you think that it’s the problem? Kibana working fine… the problem is that I can’t install fleet.
About the log error, that’s all that I have

Atenciosamente,

Gustavo Luza

4

You should be able to set the logging level in the elastic-agent.yml file:

agent.logging.level: debug

5

I will try to enable it and after back with the results

Atenciosamente,

Gustavo Luza

6

@Julia_Bardi

I updated the versions of Kibana, Elasticsearch and logstash, they are all running with the same version

image

i tried to install fleet after the update, but still getting error,

image
image1845×186 15.9 KB

this is my elastic-agent.yml used on the installation folder, i need to change something here?

image
image895×320 9.9 KB

my log folder are empty

image
image1858×294 17.7 KB

image
image694×163 5.34 KB

in each new installation attempt I am ensuring that the token generated by the kibana interface is correct in the code I am using to attempt the installation

i hope that this information can help you

7

Can you try to set the logging level to debug in elastic-agent.yml by inserting this line and check if there are more logs on install?
agent.logging.level: debug

8

I tried several ways to install, I set the logs to agent.logging.level: debug
but it didn't generate any logs, do you know the reason for this behavior?

the only log that i see is this one, that are showed to me in terminal

{"log.level":"debug","@timestamp":"2023-10-10T09:59:50.895-0300","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":307},"message":"verifying communication with running Elastic Agent daemon","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-10-10T09:59:55.541-0300","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":783},"message":"Waiting for Elastic Agent to start Fleet Server: STARTING - Starting","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2023-10-10T09:59:55.541-0300","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":806},"message":"Fleet Server - Starting","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-10-10T09:59:59.542-0300","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":783},"message":"Waiting for Elastic Agent to start Fleet Server: STARTING - Starting","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-10-10T10:00:07.545-0300","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":783},"message":"Waiting for Elastic Agent to start Fleet Server: STARTING - Starting","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-10-10T10:00:23.546-0300","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":783},"message":"Waiting for Elastic Agent to start Fleet Server: STARTING - Starting","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-10-10T10:00:55.552-0300","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":783},"message":"Waiting for Elastic Agent to start Fleet Server: STARTING - Starting","ecs.version":"1.6.0"}
Error: fleet-server failed: context canceled
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.9/fleet-troubleshooting.html
Error: enroll command failed with exit code: 1
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.9/fleet-troubleshooting.html

in my log folder i just have older logs

image
image1013×87 3.02 KB

9

I'm not sure about where agent logs should be, other than the stdout, asked the Agent team.

Could you check that the agent policy that you are using has a fleet_server integration?
It can be checked in kibana console with this ES query, the expected doc should have the inputs array populated.

GET .fleet-policies/_search?q=policy_id:2c3db780-5244-11ee-b17f-317560648b1c
{
  "size": 1, 
  "sort": [
    {
      "revision_idx": {
        "order": "desc"
      }
    }
  ]
}
10

about the location of the logs, they are defined in this path path: /var/log/elastic-agent as default in my file elastic-agent.yml within the installation folder /root/elastic-agent-8.10.3-linux-x86_64

about fleet server integration, below are some screenshots of my configuration

image
image1212×44 4.1 KB

image
image1262×334 28.7 KB

id: 2c3db780-5244-11ee-b17f-317560648b1c
revision: 3
outputs:
  default:
    type: elasticsearch
    '0': s
    '1': s
    '2': l
    '3': .
    '4': c
    '5': e
    '6': r
    '7': t
    '8': i
    '9': f
    '10': i
    '11': c
    '12': a
    '13': t
    '14': e
    '15': _
    '16': a
    '17': u
    '18': t
    '19': h
    '20': o
    '21': r
    '22': i
    '23': t
    '24': i
    '25': e
    '26': s
    '27': ':'
    '28': '['
    '29': '"'
    '30': /
    '31': e
    '32': t
    '33': c
    '34': /
    '35': c
    '36': e
    '37': r
    '38': t
    '39': s
    '40': /
    '41': a
    '42': p
    '43': m
    '44': .
    '45': w
    '46': e
    '47': b
    '48': m
    '49': a
    '50': i
    '51': s
    '52': s
    '53': i
    '54': s
    '55': t
    '56': e
    '57': m
    '58': a
    '59': s
    '60': .
    '61': c
    '62': o
    '63': m
    '64': .
    '65': b
    '66': r
    '67': /
    '68': c
    '69': a
    '70': .
    '71': c
    '72': r
    '73': t
    '74': '"'
    '75': ']'
    hosts:
      - 'https://my_url.com.br:9200'
fleet:
  hosts:
    - 'https://my_url.com.br:8220'
output_permissions:
  default:
    _elastic_agent_monitoring:
      indices:
        - names:
            - logs-elastic_agent-default
            - logs-elastic_agent.elastic_agent-default
            - logs-elastic_agent.apm_server-default
            - logs-elastic_agent.filebeat-default
            - logs-elastic_agent.filebeat_input-default
            - logs-elastic_agent.fleet_server-default
            - logs-elastic_agent.metricbeat-default
            - logs-elastic_agent.osquerybeat-default
            - logs-elastic_agent.packetbeat-default
            - logs-elastic_agent.endpoint_security-default
            - logs-elastic_agent.auditbeat-default
            - logs-elastic_agent.heartbeat-default
            - logs-elastic_agent.cloudbeat-default
            - logs-elastic_agent.cloud_defend-default
            - metrics-elastic_agent-default
            - metrics-elastic_agent.elastic_agent-default
            - metrics-elastic_agent.apm_server-default
            - metrics-elastic_agent.filebeat-default
            - metrics-elastic_agent.filebeat_input-default
            - metrics-elastic_agent.fleet_server-default
            - metrics-elastic_agent.metricbeat-default
            - metrics-elastic_agent.osquerybeat-default
            - metrics-elastic_agent.packetbeat-default
            - metrics-elastic_agent.endpoint_security-default
            - metrics-elastic_agent.auditbeat-default
            - metrics-elastic_agent.heartbeat-default
            - metrics-elastic_agent.cloudbeat-default
            - metrics-elastic_agent.cloud_defend-default
          privileges:
            - auto_configure
            - create_doc
    _elastic_agent_checks:
      cluster:
        - monitor
    5b2b0dd8-2315-4edf-8bfc-1586dac01eb1:
      indices:
        - names:
            - logs-system.auth-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - logs-system.syslog-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - logs-system.application-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - logs-system.security-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - logs-system.system-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.cpu-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.diskio-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.filesystem-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.fsstat-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.load-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.memory-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.network-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.process-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.process.summary-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.socket_summary-default
          privileges:
            - auto_configure
            - create_doc
        - names:
            - metrics-system.uptime-default
          privileges:
            - auto_configure
            - create_doc
agent:
  download:
    sourceURI: 'https://artifacts.elastic.co/downloads/'
  monitoring:
    enabled: true
    use_output: default
    namespace: default
    logs: true
    metrics: true
  features: {}
  protection:
    enabled: false
    uninstall_token_hash: ''
    signing_key: >-
      MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEAq6hlblwOAWsel2o5dt2iXn33s4+UX7SR2Q1iqvqbWimjMTl8KAamC8HiHyBCAqQb1Jt3NuMo38g4C7SODcLVg==
inputs:
  - id: fleet-server-fleet_server-a4448ce7-df1d-45e4-b047-99ee4b33384f
    name: fleet_server-2
    revision: 1
    type: fleet-server
    use_output: default
    meta:
      package:
        name: fleet_server
        version: 1.3.1
    data_stream:
      namespace: default
    package_policy_id: a4448ce7-df1d-45e4-b047-99ee4b33384f
    unused_key: not_used
  - id: logfile-system-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
    name: system-2
    revision: 1
    type: logfile
    use_output: default
    meta:
      package:
        name: system
        version: 1.19.5
    data_stream:
      namespace: default
    package_policy_id: 5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
    streams:
      - id: logfile-system.auth-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.auth
          type: logs
        ignore_older: 72h
        paths:
          - /var/log/auth.log*
          - /var/log/secure*
        exclude_files:
          - .gz$
        multiline:
          pattern: ^\s
          match: after
        tags:
          - hashicorp-vault-log
        processors:
          - add_locale: null
      - id: logfile-system.syslog-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.syslog
          type: logs
        paths:
          - /var/log/messages*
          - /var/log/syslog*
        exclude_files:
          - .gz$
        multiline:
          pattern: ^\s
          match: after
        processors:
          - add_locale: null
        ignore_older: 72h
  - id: winlog-system-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
    name: system-2
    revision: 1
    type: winlog
    use_output: default
    meta:
      package:
        name: system
        version: 1.19.5
    data_stream:
      namespace: default
    package_policy_id: 5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
    streams:
      - id: winlog-system.application-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        name: Application
        data_stream:
          dataset: system.application
          type: logs
        condition: '${host.platform} == ''windows'''
        ignore_older: 72h
      - id: winlog-system.security-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        name: Security
        data_stream:
          dataset: system.security
          type: logs
        condition: '${host.platform} == ''windows'''
        ignore_older: 72h
      - id: winlog-system.system-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        name: System
        data_stream:
          dataset: system.system
          type: logs
        condition: '${host.platform} == ''windows'''
        ignore_older: 72h
  - id: system/metrics-system-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
    name: system-2
    revision: 1
    type: system/metrics
    use_output: default
    meta:
      package:
        name: system
        version: 1.19.5
    data_stream:
      namespace: default
    package_policy_id: 5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
    streams:
      - id: system/metrics-system.cpu-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.cpu
          type: metrics
        metricsets:
          - cpu
        cpu.metrics:
          - percentages
          - normalized_percentages
        period: 10s
      - id: system/metrics-system.diskio-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.diskio
          type: metrics
        metricsets:
          - diskio
        diskio.include_devices: null
        period: 10s
      - id: system/metrics-system.filesystem-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.filesystem
          type: metrics
        metricsets:
          - filesystem
        period: 1m
        processors:
          - drop_event.when.regexp:
              system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
      - id: system/metrics-system.fsstat-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.fsstat
          type: metrics
        metricsets:
          - fsstat
        period: 1m
        processors:
          - drop_event.when.regexp:
              system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/)
      - id: system/metrics-system.load-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.load
          type: metrics
        metricsets:
          - load
        condition: '${host.platform} != ''windows'''
        period: 10s
      - id: system/metrics-system.memory-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.memory
          type: metrics
        metricsets:
          - memory
        period: 10s
      - id: system/metrics-system.network-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.network
          type: metrics
        metricsets:
          - network
        period: 10s
        network.interfaces: null
      - id: system/metrics-system.process-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.process
          type: metrics
        metricsets:
          - process
        period: 10s
        process.include_top_n.by_cpu: 5
        process.include_top_n.by_memory: 5
        process.cmdline.cache.enabled: true
        process.cgroups.enabled: false
        process.include_cpu_ticks: false
        processes:
          - .*
      - id: >-
          system/metrics-system.process.summary-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.process.summary
          type: metrics
        metricsets:
          - process_summary
        period: 10s
      - id: >-
          system/metrics-system.socket_summary-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.socket_summary
          type: metrics
        metricsets:
          - socket_summary
        period: 10s
      - id: system/metrics-system.uptime-5b2b0dd8-2315-4edf-8bfc-1586dac01eb1
        data_stream:
          dataset: system.uptime
          type: metrics
        metricsets:
          - uptime
        period: 10s
signed:
  data: >-
    eyJpZCI6IjJjM2RiNzgwLTUyNDQtMTFlZS1iMTdmLTMxNzU2MDY0OGIxYyIsImFnZW50Ijp7ImZlYXR1cmVzIjp7fSwicHJvdGVjdGlvbiI6eyJlbmFibGVkIjpmYWxzZSwidW5pbnN0YWxsX3Rva2VuX2hhc2giOiIiLCJzaWduaW5nX2tleSI6Ik1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRUFxNmhsYmx3T0FXc2VsMm81ZHQyaVhuMzNzNCtVWDdTUjJRMWlxdnFiV2ltak1UbDhLQWFtQzhIaUh5QkNBcVFiMUp0M051TW8zOGc0QzdTT0RjTFZnPT0ifX0sImlucHV0cyI6W3siaWQiOiJmbGVldC1zZXJ2ZXItZmxlZXRfc2VydmVyLWE0NDQ4Y2U3LWRmMWQtNDVlNC1iMDQ3LTk5ZWU0YjMzMzg0ZiIsIm5hbWUiOiJmbGVldF9zZXJ2ZXItMiIsInJldmlzaW9uIjoxLCJ0eXBlIjoiZmxlZXQtc2VydmVyIn0seyJpZCI6ImxvZ2ZpbGUtc3lzdGVtLTViMmIwZGQ4LTIzMTUtNGVkZi04YmZjLTE1ODZkYWMwMWViMSIsIm5hbWUiOiJzeXN0ZW0tMiIsInJldmlzaW9uIjoxLCJ0eXBlIjoibG9nZmlsZSJ9LHsiaWQiOiJ3aW5sb2ctc3lzdGVtLTViMmIwZGQ4LTIzMTUtNGVkZi04YmZjLTE1ODZkYWMwMWViMSIsIm5hbWUiOiJzeXN0ZW0tMiIsInJldmlzaW9uIjoxLCJ0eXBlIjoid2lubG9nIn0seyJpZCI6InN5c3RlbS9tZXRyaWNzLXN5c3RlbS01YjJiMGRkOC0yMzE1LTRlZGYtOGJmYy0xNTg2ZGFjMDFlYjEiLCJuYW1lIjoic3lzdGVtLTIiLCJyZXZpc2lvbiI6MSwidHlwZSI6InN5c3RlbS9tZXRyaWNzIn1dfQ==
  signature: >-
    MEYCIQD4OFhX4H7d54NRDBNrbvbnOJzikLMnGY/RON8T3Ke1owIhAPHyIhikNBbnj3oqQOEBlJ900IOGdyfTLmex3AcFJ1Rt
secret_references: []```
11

The agent policy looks good, so I'm out of ideas why the enrollment doesn't succeed.

12

sure... thats bad news...

13

I found a similar discuss thread where they have used the linux tar gz to install fleet-server: Elastic agent fails to install on Centos 7 - #2 by stephenb
Could you try again with that and see if there are any more logs in stdout or in /opt/Elastic/Agent/ ?

14

i tried again to install, but still getting the same error.
when i check journalctl -u elastic-agent i can see this "log"

Oct 11 14:42:03 elk systemd[1]: Started Elastic Agent is a unified agent to observe, monitor and protect your system..
Oct 11 14:42:03 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:03.568-0300","log.origin":{"file.name":"cmd/run.go","file.line":154},"message":"Elastic Agent started","log":{"source":"elastic-agent"},"process.pid"
Oct 11 14:42:03 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:03.568-0300","log.origin":{"file.name":"migration/migrate_config.go","file.line":35},"message":"checking stat of enc config \"/opt/Elastic/Agent/fle
Oct 11 14:42:03 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:03.568-0300","log.origin":{"file.name":"migration/migrate_config.go","file.line":36},"message":"checking stat of unenc config \"/opt/Elastic/Agent/f
Oct 11 14:42:03 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:03.568-0300","log.origin":{"file.name":"migration/migrate_config.go","file.line":35},"message":"checking stat of enc config \"/opt/Elastic/Agent/dat
Oct 11 14:42:03 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:03.568-0300","log.origin":{"file.name":"migration/migrate_config.go","file.line":36},"message":"checking stat of unenc config \"/opt/Elastic/Agent/d
Oct 11 14:42:03 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:03.788-0300","log.origin":{"file.name":"upgrade/rollback.go","file.line":113},"message":"agent is not upgradable, not starting watcher","log":{"sourc
Oct 11 14:42:03 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:03.788-0300","log.origin":{"file.name":"cmd/run.go","file.line":241},"message":"APM instrumentation disabled","log":{"source":"elastic-agent"},"ecs.v
Oct 11 14:42:03 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:03.789-0300","log.origin":{"file.name":"application/application.go","file.line":61},"message":"Gathered system information","log":{"source":"elastic-
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.077-0300","log.origin":{"file.name":"application/application.go","file.line":67},"message":"Detected available inputs and outputs","log":{"source"
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.077-0300","log.origin":{"file.name":"capabilities/capabilities.go","file.line":48},"message":"Capabilities file not found in /opt/Elastic/Agent/ca
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.077-0300","log.origin":{"file.name":"application/application.go","file.line":73},"message":"Determined allowed capabilities","log":{"source":"elas
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.275-0300","log.origin":{"file.name":"application/application.go","file.line":130},"message":"Parsed configuration and determined agent is managed 
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.275-0300","log.origin":{"file.name":"application/application.go","file.line":138},"message":"Reloading of configuration is on, frequency is set t
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.278-0300","log.logger":"api","log.origin":{"file.name":"api/server.go","file.line":74},"message":"Starting stats endpoint","log":{"source":"elasti
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.279-0300","log.logger":"api","log.origin":{"file.name":"api/server.go","file.line":76},"message":"Metrics endpoint listening on: 127.0.0.1:6791 (c
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.279-0300","log.logger":"composable","log.origin":{"file.name":"composable/controller.go","file.line":112},"message":"Starting controller for comp
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.279-0300","log.logger":"composable","log.origin":{"file.name":"composable/controller.go","file.line":155},"message":"Started controller for compo
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.279-0300","log.logger":"composable","log.origin":{"file.name":"composable/controller.go","file.line":191},"message":"Variable state changed for c
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.279-0300","log.logger":"docker","log.origin":{"file.name":"docker/client.go","file.line":49},"message":"Docker client will negotiate the API vers
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.279-0300","log.logger":"composable","log.origin":{"file.name":"kubernetessecrets/kubernetes_secrets.go","file.line":97},"message":"Kubernetes_sec
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.280-0300","log.origin":{"file.name":"application/periodic.go","file.line":77},"message":"Adding 1 file to watch","log":{"source":"elastic-agent"}
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.280-0300","log.origin":{"file.name":"application/periodic.go","file.line":93},"message":"Configuration changes detected","log":{"source":"elastic-
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.280-0300","log.origin":{"file.name":"application/periodic.go","file.line":99},"message":"Updated 1 files: /opt/Elastic/Agent/elastic-agent.yml","
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.280-0300","log.logger":"composable.providers.docker","log.origin":{"file.name":"docker/docker.go","file.line":44},"message":"Docker provider skipp
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.281-0300","log.logger":"composable","log.origin":{"file.name":"kubernetesleaderelection/kubernetes_leaderelection.go","file.line":53},"message":"
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.281-0300","log.origin":{"file.name":"config/loader.go","file.line":45},"message":"Loaded configuration from /opt/Elastic/Agent/elastic-agent.yml"
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.281-0300","log.origin":{"file.name":"config/loader.go","file.line":57},"message":"Merged configuration from /opt/Elastic/Agent/elastic-agent.yml 
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.281-0300","log.origin":{"file.name":"config/loader.go","file.line":64},"message":"Merged all configuration files from [/opt/Elastic/Agent/elastic
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.281-0300","log.logger":"composable.providers.kubernetes","log.origin":{"file.name":"kubernetes/kubernetes.go","file.line":106},"message":"Kuberne
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.281-0300","log.logger":"composable.providers.kubernetes","log.origin":{"file.name":"kubernetes/kubernetes.go","file.line":106},"message":"Kuberne
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.282-0300","log.origin":{"file.name":"upgrade/upgrade.go","file.line":99},"message":"Source URI reset from \"https://artifacts.elastic.co/downloads
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.380-0300","log.logger":"composable","log.origin":{"file.name":"composable/controller.go","file.line":207},"message":"Computing new variable state
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.382-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1063},"message":"Continue with missing \"signed\" properties: policy
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.382-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1071},"message":"Updating running component model","log":{"source":"e
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.383-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1072},"message":"Updating running component model","log":{"source":"
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.503-0300","log.logger":"composable","log.origin":{"file.name":"composable/controller.go","file.line":191},"message":"Variable state changed for c
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.603-0300","log.logger":"composable","log.origin":{"file.name":"composable/controller.go","file.line":207},"message":"Computing new variable state
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.662-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new component system/metrics-default: Starti
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.662-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new unit system/metrics-default-unique-syste
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.662-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new unit system/metrics-default: Starting: s
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.967-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new component http/metrics-monitoring: Start
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.968-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new unit http/metrics-monitoring-metrics-mon
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.968-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new unit http/metrics-monitoring: Starting: 
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.974-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1063},"message":"Continue with missing \"signed\" properties: policy
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.974-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1071},"message":"Updating running component model","log":{"source":"e
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:04.976-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1072},"message":"Updating running component model","log":{"source":"
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.976-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new component filestream-monitoring: Startin
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.976-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new unit filestream-monitoring-filestream-mo
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.976-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new unit filestream-monitoring: Starting: sp
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.976-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new component beat/metrics-monitoring: Start
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.976-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new unit beat/metrics-monitoring: Starting: 
Oct 11 14:42:04 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:04.976-0300","log.origin":{"file.name":"coordinator/coordinator.go","file.line":1247},"message":"Spawned new unit beat/metrics-monitoring-metrics-mon
Oct 11 14:42:06 elk elastic-agent[1800]: {"log.level":"info","@timestamp":"2023-10-11T14:42:06.166-0300","log.origin":{"file.name":"cmd/run.go","file.line":301},"message":"reexec shutdown channel triggered","log":{"source":"elastic-agent"},"
Oct 11 14:42:06 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:06.166-0300","log.logger":"composable","log.origin":{"file.name":"composable/controller.go","file.line":159},"message":"Stopping controller for comp
Oct 11 14:42:06 elk elastic-agent[1800]: {"log.level":"debug","@timestamp":"2023-10-11T14:42:06.166-0300","log.logger":"composable","log.origin":{"file.name":"composable/controller.go","file.line":188},"message":"Stopped controller for compo
Oct 11 14:44:06 elk systemd[1]: Stopping Elastic Agent is a unified agent to observe, monitor and protect your system....
Oct 11 14:44:06 elk systemd[1]: Stopped Elastic Agent is a unified agent to observe, monitor and protect your system..

the /opt/Elastic/Agent/ directory does not exist, I tried to create it manually and after running the installation it was removed

15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.