We have an elastic agent running a "Proofpoint On Demand" integration. However, it sporadically stops getting data. To clarify, we poll the API once every hour, and at some unpredictable point, it completely stops getting data. The only thing that helps is restarting the elastic agent, which makes the integration work again as expected. We've verified our Proofpoint API key works via curls, so it doesn't seem to have anything to do with API rate limits or timeouts. In elastic's error logs we see the following:
15:01:48.041
[elastic_agent.filebeat][info] Connection to backoff(async(tcp://our-logstash:80)) established
15:57:59.680
[elastic_agent.filebeat][error] Input 'websocket' failed with: input websocket-proofpoint_on_demand.mail-3b7399ba-2f22-4665-b00f-94c8007e71c3 failed: read tcp 10.50.49.182:36012->52.24.230.185:443: read: connection timed out
15:57:59.680
[elastic_agent.filebeat][error] failed to read websocket data
15:57:59.680
[elastic_agent.filebeat][info] unregistering
15:58:02.752
[elastic_agent.filebeat][error] failed to read websocket data
15:58:02.752
[elastic_agent.filebeat][info] unregistering
We are hoping to understand how to resolve this issue. In particular, it's bizarre that the integration fully unregisters as opposed to trying again later. Is there a way to change this unregistration behavior?