# Fleet Host healthy, but no data **URL:** \ **Category:** Endpoint Security\ **Tags:** fleet\ **Created:** [January 31, 2022, 10:44am UTC](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824 "2022-01-31T10:44:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Post date:** [January 31, 2022, 10:44am UTC](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824/1 "2022-01-31T10:44:06Z")
Hi, I have configured fleet on my ES cluster and I can see all my endpoints are healthy under the Fleet\>Agents. But I cannot see either data stream or logs of the endpoints. when I go through the ES logs, I could find the following error and I assume this is the reason or the issue. X.X.X.165 is the ES coordinate node of the cluster Y.Y.Y.198 is the endpoint ```auto [2022-01-31T14:00:48,143][WARN][o.e.h.AbstractHttpServerTransport] [esconode] **caught exception while handling client http traffic, closing connection Netty4HttpChanne** l{localAddress=/X.X.X.165:9200, remoteAddress=/Y.Y.Y.198:61139} io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:477) ~[netty-codec-4.1.66.Final.jar:4.1.66.Final] at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276) ~[netty-codec-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:166) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:719) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:620) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:583) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493) [netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:986) [netty-common-4.1.66.Final.jar:4.1.66.Final] at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [netty-common-4.1.66.Final.jar:4.1.66.Final] at java.lang.Thread.run(Thread.java:831) [?:?] Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate at sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?] at sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?] at sun.security.ssl.TransportContext.fatal(TransportContext.java:356) ~[?:?] at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293) ~[?:?] at sun.security.ssl.TransportContext.dispatch(TransportContext.java:202) ~[?:?] at sun.security.ssl.SSLTransport.decode(SSLTransport.java:172) ~[?:?] at sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:736) ~[?:?] at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:691) ~[?:?] at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:506) ~[?:?] at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:482) ~[?:?] at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:679) ~[?:?] at io.netty.handler.ssl.SslHandler$SslEngineType$3.unwrap(SslHandler.java:298) ~[netty-handler-4.1.66.Final.jar:4.1.66.Final] at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1344) ~[netty-handler-4.1.66.Final.jar:4.1.66.Final] at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1237) ~[netty-handler-4.1.66.Final.jar:4.1.66.Final] at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1286) ~[netty-handler-4.1.66.Final.jar:4.1.66.Final] at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:507) ~[netty-codec-4.1.66.Final.jar:4.1.66.Final] at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:446) ~[netty-codec-4.1.66.Final.jar:4.1.66.Final] ... 16 more ``` Following is the ES config of the X.X.X.165 ```auto cluster.name: escluster node.name: esconode node.roles: [] path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch #----------------------------------XPACK------------------------------------- xpack.security.enabled: true xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.client_authentication: required xpack.security.transport.ssl.keystore.path: elastic-certificates.p12 xpack.security.transport.ssl.truststore.path: elastic-certificates.p12 # xpack.security.http.ssl.enabled: true xpack.security.http.ssl.keystore.path: http.p12 xpack.security.authc.api_key.enabled: true #xpack.security.http.ssl.key: kifarunix-demo-fleet-server.key #xpack.security.http.ssl.certificate: kifarunix-demo-fleet-server.crt #xpack.security.http.ssl.certificate_authorities: ./ca/ca.crt bootstrap.memory_lock: true ---------------------------------- Network ----------------------------------- network.host: x.x.x..165 discovery.seed_hosts: ["x.x.x..163"] cluster.initial_master_nodes: ["esmaster"] ``` And I have enrolled the endpoint with following commad. ```auto .\elastic-agent.exe install -f --url=https://x.x.x..170:8220 --enrollment-token=ZEdYZG1uNEJMSl8zR0dKNWpQZWs6ajloVEJxak1SSS1BTDRVd2lpRGxhZw== ``` I still couldn't figure out what went wrong and really appreciate your help to resolve this matter. BR, Billz26 ---
**Author:** ![MichelLaterman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michellaterman/32/110221_2.png) [@MichelLaterman](https://discuss.elastic.co/u/MichelLaterman)\ **Post date:** [January 31, 2022, 11:48pm UTC](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824/2 "2022-01-31T23:48:34Z")
The error, and config indicate that the elastic-agent should be sending a client cert. it does not do this by default ---
**Author:** ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Post date:** [February 1, 2022, 3:29am UTC](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824/3 "2022-02-01T03:29:00Z")
Hi Michel, Thank you for the the suggestion. Can you kindly suggest me an article on how to do that. BR, Billz26 ---
**Author:** ![MichelLaterman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michellaterman/32/110221_2.png) [@MichelLaterman](https://discuss.elastic.co/u/MichelLaterman)\ **Post date:** [February 2, 2022, 9:29pm UTC](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824/4 "2022-02-02T21:29:34Z")
If you need to enable PKI certificates refer to: [Configure the Elasticsearch output | Fleet and Elastic Agent Guide [7.17] | Elastic](https://www.elastic.co/guide/en/fleet/current/elasticsearch-output.html#output-elasticsearch-pki-certs-authentication-settings). The `ssl.cert` and `ssl.key` option can be provided through Kibana, however I don't think multiplatform deployments are supported by this due to filepath handling. ---
**Author:** ![Billz1026](https://avatars.discourse-cdn.com/v4/letter/b/67e7ee/32.png) [@Billz1026](https://discuss.elastic.co/u/Billz1026)\ **Post date:** [February 3, 2022, 3:19am UTC](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824/5 "2022-02-03T03:19:32Z")
Hi Michel, Thank for the reply. BR, Billz26 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 3, 2022, 3:19am UTC](https://discuss.elastic.co/t/fleet-host-healthy-but-no-data/295824/6 "2022-03-03T03:19:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.