# Fleet agent tls settings **URL:** \ **Category:** Elasticsearch\ **Tags:** fleet\ **Created:** [January 14, 2021, 11:23pm UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191 "2021-01-14T23:23:32Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![gregorys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gregorys/32/67574_2.png) [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Post date:** [January 14, 2021, 11:23pm UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/1 "2021-01-14T23:23:32Z")
Hi, I installed a fleet agent, its state in Kibana is online and its receiving logs over the UDP port configured in an integration. However I don't see a data stream, looks like it's not sending these logs to elasticsearch, and I'm seeing these logs on the nodes: ```auto [2021-01-15T00:17:16,287][WARN][o.e.x.s.t.n.SecurityNetty4HttpServerTransport] [elastic015] received plaintext http traffic on an https channel, closing connection Netty4HttpChannel{localAddress=/xx.xxx.xx.xx:9200, remoteAddress=/xxx.xx.xxx.xxx:56656} ``` The Elasticsearch URL is set to [https://myhost:9200](https://myhost:9200) in Fleet settings, with these additional parameters: ```auto protocol: "https" ssl.verification_mode: "none" ``` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 15, 2021, 1:19am UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/2 "2021-01-15T01:19:54Z")
Is this a self Signed Cert if I think you are going to need to use the `--insecure` setting on the command line see [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-cmd-options.html#_synopsis) ---
**Author:** ![gregorys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gregorys/32/67574_2.png) [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Post date:** [January 15, 2021, 1:57am UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/3 "2021-01-15T01:57:04Z")
I have used this setting and the enrollment in Kibana was successful. The agent is online. It's the connection from the agent to elasticsearch that's not working. I added an integration and the agent is receiving logs on the configured udp socket, but this data is not getting to elasticsearch. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 15, 2021, 1:58am UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/4 "2021-01-15T01:58:24Z")
can you post your whole agent config? Also is this a self signed cert? ---
**Author:** ![gregorys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gregorys/32/67574_2.png) [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Post date:** [January 15, 2021, 11:24am UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/5 "2021-01-15T11:24:43Z")
Yes the certificate is self signed, in logstash & beats I use the "cacert" setting to provide the elastic CA certificate, which works fine. I can't find such a setting for the fleet agent configuration. I enrolled the agent using `elastic-agent enroll https://kibana.masked.host djhrSkEzY0feLdgJ2c3FxggTmRfX21GQkhRejpegJ6486eMpgNNLW53dw== -i` The fleet.yml: ```auto agent: id: eb051576-6041-43a8-84b2-85ef06b8f96d fleet: enabled: true access_api_key: LTNSUef456E9xSmFzai1TNG13bUe54PGEvwiCGmN4TlhEUQ== kibana: protocol: https host: kibana.masked.host hosts: - kibana.masked.host timeout: 5m0s ssl: verification_mode: none renegotiation: never reporting: threshold: 10000 check_frequency_sec: 30 agent: id: "" ``` I've added an integration and set it to UDP:9503. The agent has received this configuration and is listening on this port: ```auto COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME filebeat 47953 root 19u IPv6 4338972 0t0 UDP *:9503 ``` I can see traffic coming in from the appliance to the agent. I can also see outgoing traffic to the elasticsearch hosts, but on the elastic nodes I see the "received plaintext http traffic on an https channel" warning. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 16, 2021, 2:01am UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/6 "2021-01-16T02:01:17Z")
Hmmm.... fleet is still early in its lifecycle.... I am not sure what is happening... Which integration is this? (although I don't think that matters) you could dig way into the config settings I would be curious what you see. buried deep there is a file named `action_store.yml` something like `/opt/Elastic/Agent/data/elastic-agent-1da173/action_store.yml` There is an `outputs` section curious what you see there. ---
**Author:** ![gregorys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gregorys/32/67574_2.png) [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Post date:** [January 16, 2021, 12:23pm UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/7 "2021-01-16T12:23:53Z")
The Barracuda WAF integration. I don't see the error anymore, and after digging deeper it works fine actually. The output section contains the correct settings. I expected this data flow to be visible under Fleet -\> data streams, which is empty? But under index managegement -\> data streams, I saw a "logs-barracuda.waf-default", and found that the index it's logging to is a hidden index `.ds-logs-barracuda.waf-default-000001`. So, works fine after all. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 16, 2021, 3:45pm UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/8 "2021-01-16T15:45:50Z")
Good it's working I would expect it to show in data streams hmmmm 7.10.2 was just released perhaps take a look. ---
**Author:** ![gregorys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gregorys/32/67574_2.png) [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Post date:** [January 20, 2021, 12:09pm UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/9 "2021-01-20T12:09:10Z")
Same in 7.10.2 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 17, 2021, 12:09pm UTC](https://discuss.elastic.co/t/fleet-agent-tls-settings/261191/10 "2021-02-17T12:09:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.