Fleet 0.0.0.0 address after Elastic Agent install

Elastic Security Endpoint Security
,
1

Hi!
I've installed Elastci Agent with 10.10.10.19 address for both Kibana and Elasticsearch.
However, after is starts I get this error "fail to checkin to fleet: Post "https://0.0.0.0:5601/api/fleet/agents/ID/checkin?": dial tcp 0.0.0.0:5601: connectex: No connection could be made because the target machine actively refused it.".
I don't understand from where is configured fleet.yml file because after every restart it is created and I cannot change the address in it.

Thank you!

2

Not sure if this will solve your current problem, but in the Agents screen in Fleet, in the top right hand corner there is a settings cog, click that and make sure the address and port of your elasticsearch and kibana server(s) is defined. I think that's where Fleet will pull this data from, but I may be wrong!

3

Hey Cosmin are you enrolling your agent into Fleet for the first time, or has it already connected successfully?

For agents enrolled into Fleet, it is defined in the settings that John mentioned. The agent policy includes the list of kibana URLs, which Fleet sends to the agents after they enroll. If you run on cloud the kibana URL will be set automatically. For self-managed clusters you have to set the URL yourself. See how to set the URL here Quick start: Get logs and metrics into the Elastic Stack | Fleet User Guide [7.11] | Elastic

4

OK! I've resolved this problem. Thank you!
But now after 2/3 minutes agent goes offline and I'm not receiving any log in this time.
Any troubleshoot?

5

This is the error mainly "message: Application: metricbeat--7.11.1[e9e46cd0-792e-11eb-8062-9be23ea21776]: State changed to FAILED: 1 error: 1 error: Error creating runner from config: 1 error: metricset 'system/load' not found"

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.