Hello fellows o/
I'm facing a problem to activate my Fleet Server. All my cluster is running on CentOS 7.
I used rpm instalation of elastic-agent 7.15.2 and give the follow commands:
On my Elasticsearch node 2 (where I'll make the fleet server):
sudo elastic-agent enroll -f --fleet-server-es=https://elasticnode2.exemple:9220 --fleet-server-service-token=90lettersandnummbers --fleet-server-policy=36something --fleet-server-es-ca=/path/to/ca.crt
The agent enrolled but de status is stucked on "Updating":
The output for sudo elastic-agent status
is:
Status: FAILED
Message: (no message)
Applications:
* fleet-server (FAILED)
Error - listen tcp: address https://elasticnode2.exemple:8220: too many colons in address
* filebeat (HEALTHY)
Running
* metricbeat (HEALTHY)
Running
I've opened the ports 8220 and 443 on firewall-cmd but when I start the agent and run netstat -tulpn
I can't see the server listening on these ports:
sudo firwall-cmd --list-ports:
9220/tcp 9300/tcp 3202/tcp 8220/tcp 8220/udp 443/tcp
netstat -tulpn:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp6 0 0 ::1:6789 :::* LISTEN -
tcp6 0 0 10.xxx.xxx.xxx:9300 :::* LISTEN -
tcp6 0 0 ::1:9300 :::* LISTEN -
tcp6 0 0 ::1:25 :::* LISTEN -
tcp6 0 0 10.xxx.xxx.xxx:9220 :::* LISTEN -
tcp6 0 0 ::1:9220 :::* LISTEN -
Here is a piece of the /var/log/elastic-agent/latestlog:
2022-04-27T10:05:02.616-0300 INFO status/reporter.go:236 Elastic Agent status changed to: 'online'
2022-04-27T10:05:02.616-0300 INFO log/reporter.go:40 2022-04-27T10:05:02-03:00 - message: Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to RESTARTING: - type: 'STATE' - sub_type: 'STARTING'
2022-04-27T10:05:02.617-0300 INFO fleet/reporter.go:156 fleet reporter dropped event because threshold[10000] was reached: &{7e07bcbd-eea9-4668-b840-84c2d0aec5df STATE {13876260790614264400 49569222163401 0x55d16df49240} STARTING Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to RESTARTING: Restarting map[]}
2022-04-27T10:05:02.617-0300 INFO log/reporter.go:40 2022-04-27T10:05:02-03:00 - message: Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2022-04-27T10:05:02.617-0300 INFO log/reporter.go:40 2022-04-27T10:05:02-03:00 - message: Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to RESTARTING: Restarting - type: 'STATE' - sub_type: 'STARTING'
2022-04-27T10:05:02.618-0300 INFO fleet/reporter.go:156 fleet reporter dropped event because threshold[10000] was reached: &{7e07bcbd-eea9-4668-b840-84c2d0aec5df STATE {13876260791368871124 49569903028301 0x55d16df49240} STARTING Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to STARTING: Starting map[]}
2022-04-27T10:05:02.618-0300 INFO fleet/reporter.go:156 fleet reporter dropped event because threshold[10000] was reached: &{7e07bcbd-eea9-4668-b840-84c2d0aec5df STATE {13876260802608945464 49580405684601 0x55d16df49240} STARTING Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to RESTARTING: map[]}
2022-04-27T10:05:03.253-0300 INFO log/reporter.go:40 2022-04-27T10:05:03-03:00 - message: Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2022-04-27T10:05:03.253-0300 INFO fleet/reporter.go:156 fleet reporter dropped event because threshold[10000] was reached: &{7e07bcbd-eea9-4668-b840-84c2d0aec5df STATE {13876260802610783164 49580407522301 0x55d16df49240} STARTING Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to STARTING: Starting map[]}
2022-04-27T10:05:03.753-0300 ERROR status/reporter.go:236 Elastic Agent status changed to: 'error'
2022-04-27T10:05:03.753-0300 ERROR log/reporter.go:36 2022-04-27T10:05:03-03:00 - message: Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to FAILED: Error - listen tcp: address https://elasticnode2.exemple:8220: too many colons in address - type: 'ERROR' - sub_type: 'FAILED'
2022-04-27T10:05:03.754-0300 INFO fleet/reporter.go:156 fleet reporter dropped event because threshold[10000] was reached: &{7e07bcbd-eea9-4668-b840-84c2d0aec5df STATE {13876260802611290964 49580408029901 0x55d16df49240} STARTING Application: fleet-server--7.15.2[7e07bcbd-eea9-4668-b840-84c2d0aec5df]: State changed to RESTARTING: Restarting map[]}
Some prints that can help:
I don't know how can I get the elastic-agent works and make the server listen on 8220. I've tried on logstash server too and get the same error: Error - listen tcp: address https://logstash.exemple:8220: too many colons in address
I hope you can help me