Hi @warkolm,
I managed to get more logs from elastic agent. Please have a check if this helps.
{"log.level":"info","@timestamp":"2022-11-09T13:05:10.976Z","log.origin":{"file.name":"application/application.go","file.line":67},"message":"Detecting execution mode","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:10.978Z","log.origin":{"file.name":"application/application.go","file.line":92},"message":"Agent is managed by Fleet","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:10.978Z","log.origin":{"file.name":"capabilities/capabilities.go","file.line":59},"message":"capabilities file not found in C:\\Program Files\\Elastic\\Agent\\capabilities.yml","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2022-11-09T13:05:10.978Z","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls_config.go","file.line":101},"message":"SSL/TLS verifications disabled.","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:11.226Z","log.logger":"composable.providers.docker","log.origin":{"file.name":"docker/docker.go","file.line":43},"message":"Docker provider skipped, unable to connect: protocol not available","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:11.230Z","log.logger":"api","log.origin":{"file.name":"api/server.go","file.line":62},"message":"Starting stats endpoint","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:11.230Z","log.origin":{"file.name":"application/managed_mode.go","file.line":291},"message":"Agent is starting","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:11.230Z","log.logger":"api","log.origin":{"file.name":"api/server.go","file.line":64},"message":"Metrics endpoint listening on: \\\\.\\pipe\\elastic-agent (configured: npipe:///elastic-agent)","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2022-11-09T13:05:11.916Z","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls_config.go","file.line":101},"message":"SSL/TLS verifications disabled.","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2022-11-09T13:05:13.017Z","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls_config.go","file.line":101},"message":"SSL/TLS verifications disabled.","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2022-11-09T13:05:13.017Z","log.logger":"tls","log.origin":{"file.name":"tlscommon/tls_config.go","file.line":101},"message":"SSL/TLS verifications disabled.","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:13.075Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":48},"message":"New State ID is j5hv9vph","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:13.075Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":49},"message":"Converging state requires execution of 5 step(s)","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:13.204Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:13.345Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:13Z - message: Application: metricbeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:15.818Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:15Z - message: Application: osquerybeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:19.567Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:19Z - message: Application: metricbeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:20.392Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:20Z - message: Application: endpoint-security--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:21.760Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:21Z - message: Application: osquerybeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:26.505Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:26Z - message: Application: filebeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:27.359Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:27.461Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:27Z - message: Application: filebeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:28.069Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:28.194Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:28Z - message: Application: metricbeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:28.682Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":66},"message":"Updating internal state","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:31.873Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:31Z - message: Application: filebeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:32.526Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:32Z - message: Application: filebeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:05:34.107Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:05:34Z - message: Application: metricbeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-09T13:05:51.053Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:06:05.642Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:06:05Z - message: Application: endpoint-security--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to CONFIG: - type: 'STATE' - sub_type: 'CONFIG'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-09T13:06:05.742Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-09T13:06:05Z - message: Application: endpoint-security--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Protecting with policy {e079907c-d697-4d87-9f76-a5d5e48baacc} - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-09T13:07:27.220Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-09T13:10:03.289Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-09T13:16:30.985Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T07:59:44.641Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:05.439Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":48},"message":"New State ID is 33G9TfKp","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:05.439Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":49},"message":"Converging state requires execution of 5 step(s)","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:05.559Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:05.559Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:05.561Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'metricbeat' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:06.087Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:06Z - message: Application: metricbeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:06.263Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:06Z - message: Application: metricbeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:07.924Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for osquerybeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:07.924Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for osquerybeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:07.924Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'osquerybeat' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:08.449Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:08Z - message: Application: osquerybeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:08.621Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:08Z - message: Application: osquerybeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:12.099Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for endpoint-security.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:12.099Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for endpoint-security.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:12.223Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:12.223Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:12.224Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'filebeat' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:12.365Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:12Z - message: Application: metricbeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:12.755Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:12Z - message: Application: filebeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:13.091Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:13Z - message: Application: filebeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:13.744Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:13.744Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:13.746Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'filebeat_monitoring' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:14.273Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:14Z - message: Application: filebeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:14.434Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:14Z - message: Application: filebeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:14.683Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:14Z - message: Application: osquerybeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:15.063Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:15.063Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:15.065Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'metricbeat_monitoring' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:16.588Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:16Z - message: Application: metricbeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:16.651Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:16Z - message: Application: metricbeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:17.302Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":66},"message":"Updating internal state","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:18.325Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:18Z - message: Application: filebeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:19.934Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:19Z - message: Application: filebeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T08:05:22.891Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T08:05:22Z - message: Application: metricbeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T08:05:39.450Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T08:07:09.037Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T08:09:35.821Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T08:17:01.497Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T08:24:09.812Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T14:57:48.689Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:17.625Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":48},"message":"New State ID is gx8LiZLb","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:17.625Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":49},"message":"Converging state requires execution of 5 step(s)","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:17.743Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:17.743Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:17.745Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'metricbeat' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:19.269Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:19Z - message: Application: metricbeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:19.386Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:19Z - message: Application: metricbeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:21.052Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for osquerybeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:21.052Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for osquerybeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:21.053Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'osquerybeat' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:21.578Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:21Z - message: Application: osquerybeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:21.707Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:21Z - message: Application: osquerybeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:24.580Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for endpoint-security.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:24.580Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for endpoint-security.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:24.707Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:24.707Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:24.708Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'filebeat' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:25.240Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:25Z - message: Application: filebeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:25.378Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:25Z - message: Application: filebeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:25.382Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:25Z - message: Application: metricbeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:26.004Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:26.004Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for filebeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:26.009Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'filebeat_monitoring' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:27.533Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:27Z - message: Application: filebeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:27.620Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:27Z - message: Application: osquerybeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:27.689Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:27Z - message: Application: filebeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:28.319Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-install' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:28.319Z","log.origin":{"file.name":"operation/operator.go","file.line":284},"message":"operation 'operation-start' skipped for metricbeat.7.17.4","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:28.325Z","log.origin":{"file.name":"process/configure.go","file.line":50},"message":"initiating restart of 'metricbeat_monitoring' due to config change","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:28.645Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:28Z - message: Application: endpoint-security--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to CONFIG: Protecting with policy {e079907c-d697-4d87-9f76-a5d5e48baacc} - type: 'STATE' - sub_type: 'CONFIG'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:28.781Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:28Z - message: Application: endpoint-security--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Protecting with policy {e079907c-d697-4d87-9f76-a5d5e48baacc} - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:28.849Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:28Z - message: Application: metricbeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:28.944Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:28Z - message: Application: metricbeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:29.712Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":66},"message":"Updating internal state","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:30.533Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:30Z - message: Application: filebeat--7.17.4[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:33.401Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:33Z - message: Application: filebeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-11-10T15:50:35.227Z","log.origin":{"file.name":"log/reporter.go","file.line":40},"message":"2022-11-10T15:50:35Z - message: Application: metricbeat--7.17.4--36643631373035623733363936343635[3e35c734-8f13-4d85-8102-e9e8a33f0595]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T15:50:51.861Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T15:53:08.203Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T15:55:32.784Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T16:01:59.810Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2022-11-10T16:03:26.299Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: fail to checkin to fleet-server: Post \"https://XXXXXXX:9243/api/fleet/agents/xxxxx-yyyy-zzzz-aaaa-bbbbbbbb/checkin?\": EOF","ecs.version":"1.6.0"}