first, my elk server version is 7.17.7,and deploy by docker ,such as logstach,kibana,elasticsearch,server ip is 10.30.25.223 。port forward has added to the firewall (sonicwall), 10.30.25.223: 5601,10.30.25.223:9200,10.30.25.231:8220 ,so i can add a test server and monitoring his logs.
today ,i am using this command below install fleet-server on an centos 7.5(10.30.25.231) 。
sudo ./elastic-agent install
--fleet-server-es=http://public:9200
--fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NzY4ODUxNzQxNjg6M0JvUE9GT1hUaUNxMUlTZ1pOdUotdw
--fleet-server-policy=6cf07a90-8b4f-11ed-827f-f961fecd5cfd
--fleet-server-insecure-http
and it shows :
Successfully enrolled the Elastic Agent.
Elastic Agent has been successfully installed.
but unfortunately
cd /opt/Elastic/Agent/data/elastic-agent-2b200b/logs/default
tail -f fleet-server-json.log
{"log.level":"info","service.name":"fleet-server","@timestamp":"2023-02-20T09:43:15.383Z","message":"starting communication connection back to Elastic Agent"}
{"log.level":"info","service.name":"fleet-server","@timestamp":"2023-02-20T09:43:15.384Z","message":"waiting for Elastic Agent to send initial configuration"}
{"log.level":"error","service.name":"fleet-server","error.message":"only 1 fleet-server input can be defined accessing config","@timestamp":"2023-02-20T09:43:15
i have search this error by bing and google , but find nothing .