Message: app heartbeat--8.4.3-d6501b26: Missed two check-in elastic-agent standalone

Elastic Stack Beats
,
1

I've used the code mentioned below, and when i log into one of the agents and do ./elastic-agent status i get the following error

Capture
Capture705×174 9.34 KB

and the logs for kibana states
Capture
Capture1343×156 15.6 KB

sample code

apiVersion: v1
kind: ConfigMap
metadata:
  name: agent-node-datastreams
  namespace: elastic
  labels:
    k8s-app: elastic-agent-standalone
data:
  agent.yml: |-
    outputs:
      default:
        type: elasticsearch
        protocol: https
        ssl.verification_mode: 'none'
        allow_older_versions: true
        hosts:
          - >-
            ${ES_HOST}
        username: ${ES_USERNAME}
        password: ${ES_PASSWORD}
    agent:
      monitoring:
        enabled: true
        use_output: default
        logs: true
        metrics: false
    providers.kubernetes:
      node: ${NODE_NAME}
      scope: node
    inputs:
      - id: heartbeat
        type: synthetics
        use_output: default
        data_stream:
          namespace: heartbeat
        streams:
          - data_stream:
              dataset: heartbeat
              type: synthetics
            hosts: ["x.x.x.x"]
            schedule: '@every 3s'
            timeout: 16s
            check.response.status: [200]

any response on this would be much appreciated by this novice.

2

Sorry to hear about this issue, but we're here to help. Can you share your logs for heartbeat from the Fleet UI? You can find information on how to do that here: Monitor Elastic Agents | Fleet and Elastic Agent Guide [8.6] | Elastic

3

I am using standalone elastic agent, not managed by fleet

4

Hi @Bhrugu_Sharma,

When Heartbeat is reported as DEGRADED, it won't appear inside elastic-agent diagnostics since it's an error preventing ipc.

This issue in K8s is most of the times related to user/file permissions. I'd recommend avoiding running elastic-agent under root. There's a default elastic-agent user (id=1000) which is configured with required file permissions inside the container.
If running as root is required, I'd suggest setting up the underlying filesystem by hand and making sure file permissions allow access for id=1000.
This should be fixed for 8.7, but until then it's a constraint we have to work with.

If you have access to the container, it's still possbile to get heartbeat logs (if there any) by reading directly from /usr/share/elastic-agent/state/data/logs/default/heartbeat*. If there isn't any log files, then it's most likely a directory permission error.

Hope it helps.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.