I encountered a problem that completely interferes with the normal operation of the service.
I opened an issue on Git, but so far they are silent, I want to know if this is the expected behavior
Details below
Stack Version: 8.14.3-8.17.1 basic license
Original install method (e.g. download page, yum, from source, etc.): package managers & docker images
Describe the bug: Setting default output to logstash completely prevents the creation of a new fleet server on tested on versions 8.14.3, 8.15.5, 8.16.3, 8.17.1
On 8.7 it works just fine as expected by the way
Steps to reproduce:
- Create an output of type logstash
- Make it the default output
- Try to create a new fleet server
Current behavior: It is impossible to create a new Fleet server & it's policy at all, an error appears that the Fleet server cannot be configured for the Logstash type output
It is also impossible to add the Fleet server integration to a previously created policy with logstash output type for integrations output
Other outputs are grayed out due to the limitations of the basic licenses, so in the end all the selection options are grayed out
At the same time, the standard elastic output is present in the integration output settings in the Fleet server policy settings, but it cannot be selected
At least in tested previous version of 8.7.0, with the same actions it is possible to create a new fleet server and a policy for it, but in the fleet policy settings, in the integration output, logstash is still selected since it is default but grayed out, but it is possible to select an elastic output
So in this version it is possible to create a fleet policy with an incorrect output setting, which can later be switched to the correct output.
Expected behavior: In versions 8.14.3-8.17.1 it's expected to be able to successfully create a new fleet server and policy for it, but allow the output to be changed to the correct one later, as it is done in 8.7.0
Or do not set logstash as the default output for integrations (even if it is enabled as default) when creating a fleet server and its policy, set elastic output automatically instead
Screenshots (if relevant):
8.7.0
8.14.3-8.17.1
Provide logs and/or server output (if relevant): kibana-1 | [2025-01-23T10:43:13.196+00:00][ERROR][plugins.fleet] Integration "fleet_server" cannot be added to agent policy "Fleet Server policy 1" because it uses output type "logstash".
Any additional context:
In theory, you can get around the problem by switching the default output to elastic to create a new fleet, but this will break all active agents that use logstash, for example, for filtering or transformation and do not see elastic directly. If there are many agents, this will break the entire workflow and you will have to reinstall all agents after returning the default output to logstash. And if in the future you need to add a new fleet, you will have to break all agents each time. Since there is a way to solve or bypass the problem, although it is extremely undesirable, so I believe that this is not how it was intended and there should be an option at least like the one in version 8.7