So I currently have an Elastic stack deployment with two systems. One with Fleet server installed and a second with Elasticsearch and an elastic agent deployed. We managed to get the stack setup with Kibana and Fleet server on the first machine and the SonicWall integration added to the elastic agent on the second machine. So far so good. The agent is picking up metrics and forwarding logs to the SonicWall Dashboard. We recently spun up a Kubernetes cluster to deploy containers with elastic agents configured to pick up logs from additional firewalls. The cluster was deployed with a DaemonSet on minikube and are detected as healthy by Fleet with metrics coming in that are viewable for each individual container.
However, the problem emerges when we try to forward logs to these containers. So far we've configured each one with the same sonicwall integration but with each detecting logs on a different port. FW rules were put in place identical to the first and still running sonicwall infused elastiic agent with the only difference being the port it is forwarded to in order to match the port configured in the sonicwall integration.
However, the Sonicwall dashboard does not see these additional firewalls. Only the first one thhat was configured directly on the host. Going to test the agent on another host to see if it makes a difference but there isn't really any documentation on the topic of multiple firewalls other than the mention that in the instance of multiple firewalls, the value of the observer.name entry can be used to differentiate between them. However the dashboard does not reflect additional observer.name options except for the one we had running from the onset.
I'm new to these forums so if anything is needed from me to provide additional insight please don't hesitate to ask. Thank you in advance to your attention i cant imagine i'll be the only one facing this issue.