Unable to install fleet server

I'm trying to install fleet server on my local server (the same where elasticsearch is installed) and I'm not succeeding. I've tried to uninstall and reinstall elastic-agent 7.14 and it doesn't work.
the commands and the output are below:

root@abc:/home/# sudo elastic-agent enroll  -f --url=http://10.81.xxx.xxx:8220 --fleet-server-es=https://10.81.xxx.xxx:9200 --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VxxxxxxxxxxxxxxxNDU6d21JUTUtUWxTNzYtR2xyTkZEUXNIQQ --fleet-server-policy=fc2498e0-e3fd-11eb-8662-35090124ff70 --insecure --fleet-server-es-ca=ca.crt --fleet-server-cert=fleet..crt --fleet-server-cert-key=fleet.key --enrollment-token=1bb75d8b-94ca-4b7d-b268-cc7339xxxxxx
2021-08-26T18:28:01.972-0300    INFO    cmd/enroll_cmd.go:526   Spawning Elastic Agent daemon as a subprocess to complete bootstrap process.
2021-08-26T18:28:02.193-0300    INFO    application/application.go:66   Detecting execution mode
2021-08-26T18:28:02.195-0300    INFO    application/application.go:87   Agent is in Fleet Server bootstrap mode
2021-08-26T18:28:02.977-0300    INFO    cmd/enroll_cmd.go:668   Waiting for Elastic Agent to start Fleet Server
2021-08-26T18:28:03.054-0300    INFO    [api]   api/server.go:62        Starting stats endpoint
2021-08-26T18:28:03.054-0300    INFO    application/fleet_server_bootstrap.go:124       Agent is starting
2021-08-26T18:28:03.055-0300    INFO    [api]   api/server.go:64        Metrics endpoint listening on: /var/lib/elastic-agent/data/tmp/elastic-agent.sock (configured: unix:///var/lib/elastic-agent/data/tmp/elastic-agent.sock)
2021-08-26T18:28:03.056-0300    INFO    application/fleet_server_bootstrap.go:134       Agent is stopped
2021-08-26T18:28:03.061-0300    INFO    stateresolver/stateresolver.go:48       New State ID is p2iK6r5S
2021-08-26T18:28:03.061-0300    INFO    stateresolver/stateresolver.go:49       Converging state requires execution of 1 step(s)
2021-08-26T18:28:03.225-0300    INFO    operation/operator.go:259       operation 'operation-install' skipped for fleet-server.7.14.0
2021-08-26T18:28:03.712-0300    INFO    log/reporter.go:40      2021-08-26T18:28:03-03:00 - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:28:03.714-0300    INFO    stateresolver/stateresolver.go:66       Updating internal state
2021-08-26T18:28:03.986-0300    INFO    cmd/enroll_cmd.go:701   Fleet Server - Starting
2021-08-26T18:28:04.298-0300    INFO    log/reporter.go:40      2021-08-26T18:28:04-03:00 - message: Application: fleet-server--7.14.0[]: State changed to RESTARTING: exited with code: 1 - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:28:04.299-0300    INFO    log/reporter.go:40      2021-08-26T18:28:04-03:00 - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:28:04.299-0300    INFO    log/reporter.go:40      2021-08-26T18:28:04-03:00 - message: Application: fleet-server--7.14.0[]: State changed to RESTARTING: Restarting - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:28:04.875-0300    INFO    log/reporter.go:40      2021-08-26T18:28:04-03:00 - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:28:10.001-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:28:16.016-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:28:22.035-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:28:28.056-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:28:34.070-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:28:40.083-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:28:46.098-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:28:52.111-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:28:58.124-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:29:04.144-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:29:08.067-0300    WARN    status/reporter.go:236  Elastic Agent status changed to: 'degraded'
2021-08-26T18:29:08.067-0300    INFO    log/reporter.go:40      2021-08-26T18:29:08-03:00 - message: Application: fleet-server--7.14.0[]: State changed to DEGRADED: Missed last check-in - type: 'STATE' - sub_type: 'RUNNING'
2021-08-26T18:29:08.153-0300    INFO    cmd/enroll_cmd.go:682   Fleet Server - Missed last check-in
2021-08-26T18:29:08.153-0300    WARN    [tls]   tlscommon/tls_config.go:98      SSL/TLS verifications disabled.
2021-08-26T18:29:08.344-0300    INFO    cmd/enroll_cmd.go:414   Starting enrollment to URL: http://10.81.xxx.xxx:8220/
2021-08-26T18:29:08.448-0300    WARN    cmd/enroll_cmd.go:425   Remote server is not ready to accept connections, will retry in a moment.
2021-08-26T18:30:08.075-0300    ERROR   status/reporter.go:236  Elastic Agent status changed to: 'error'
2021-08-26T18:30:08.075-0300    ERROR   log/reporter.go:36      2021-08-26T18:30:08-03:00 - message: Application: fleet-server--7.14.0[]: State changed to FAILED: Missed two check-ins - type: 'ERROR' - sub_type: 'FAILED'
2021-08-26T18:30:08.449-0300    INFO    cmd/enroll_cmd.go:432   Retrying enrollment to URL: http://10.81.200.160:8220/
2021-08-26T18:30:08.554-0300    WARN    cmd/enroll_cmd.go:425   Remote server is not ready to accept connections, will retry in a moment.
2021-08-26T18:32:08.556-0300    INFO    cmd/enroll_cmd.go:432   Retrying enrollment to URL: http://10.81.200.160:8220/
2021-08-26T18:32:08.659-0300    WARN    cmd/enroll_cmd.go:425   Remote server is not ready to accept connections, will retry in a moment.

and gets stuck on the "Remote server is not ready to accept connections, will retry in a moment". forever

1 Like

on a second run without some flags I'm having this error: "missing enrollment api key"

root@abc:/home/# sudo elastic-agent enroll  -f --url=https://10.81.xxx.xxx:8220 --fleet-server-es=https://10.81.xxx.xxx:9200 --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VxxxxxxxxxxxxxxxNDU6d21JUTUtUWxTNzYtR2xyTkZEUXNIQQ --fleet-server-policy=fc2498e0-e3fd-11eb-8662-35090124ff70 --insecure --fleet-server-es-ca=ca.crt
2021-08-26T18:41:09.090-0300    INFO    cmd/enroll_cmd.go:354   Generating self-signed certificate for Fleet Server
2021-08-26T18:41:09.954-0300    INFO    cmd/enroll_cmd.go:526   Spawning Elastic Agent daemon as a subprocess to complete bootstrap process.
2021-08-26T18:41:10.139-0300    INFO    application/application.go:66   Detecting execution mode
2021-08-26T18:41:10.141-0300    INFO    application/application.go:87   Agent is in Fleet Server bootstrap mode
2021-08-26T18:41:10.958-0300    INFO    cmd/enroll_cmd.go:668   Waiting for Elastic Agent to start Fleet Server
2021-08-26T18:41:11.020-0300    INFO    [api]   api/server.go:62        Starting stats endpoint
2021-08-26T18:41:11.020-0300    INFO    application/fleet_server_bootstrap.go:124       Agent is starting
2021-08-26T18:41:11.020-0300    INFO    [api]   api/server.go:64        Metrics endpoint listening on: /var/lib/elastic-agent/data/tmp/elastic-agent.sock (configured: unix:///var/lib/elastic-agent/data/tmp/elastic-agent.sock)
2021-08-26T18:41:11.021-0300    INFO    application/fleet_server_bootstrap.go:134       Agent is stopped
2021-08-26T18:41:11.025-0300    INFO    stateresolver/stateresolver.go:48       New State ID is Etq-nzJP
2021-08-26T18:41:11.025-0300    INFO    stateresolver/stateresolver.go:49       Converging state requires execution of 1 step(s)
2021-08-26T18:41:11.132-0300    INFO    operation/operator.go:259       operation 'operation-install' skipped for fleet-server.7.14.0
2021-08-26T18:41:12.107-0300    INFO    log/reporter.go:40      2021-08-26T18:41:12-03:00 - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:41:12.110-0300    INFO    stateresolver/stateresolver.go:66       Updating internal state
2021-08-26T18:41:12.693-0300    INFO    log/reporter.go:40      2021-08-26T18:41:12-03:00 - message: Application: fleet-server--7.14.0[]: State changed to RESTARTING: exited with code: 1 - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:41:12.694-0300    INFO    log/reporter.go:40      2021-08-26T18:41:12-03:00 - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:41:12.694-0300    INFO    log/reporter.go:40      2021-08-26T18:41:12-03:00 - message: Application: fleet-server--7.14.0[]: State changed to RESTARTING: Restarting - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:41:12.964-0300    INFO    cmd/enroll_cmd.go:701   Fleet Server - Restarting
2021-08-26T18:41:13.260-0300    INFO    log/reporter.go:40      2021-08-26T18:41:13-03:00 - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-08-26T18:41:13.965-0300    INFO    cmd/enroll_cmd.go:701   Fleet Server - Starting
2021-08-26T18:41:19.978-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:41:25.992-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:41:32.004-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:41:38.016-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:41:44.028-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:41:50.040-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:41:56.055-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:42:02.070-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:42:08.084-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:42:14.102-0300    INFO    cmd/enroll_cmd.go:706   Fleet Server - Starting
2021-08-26T18:42:16.030-0300    INFO    log/reporter.go:40      2021-08-26T18:42:16-03:00 - message: Application: fleet-server--7.14.0[]: State changed to DEGRADED: Missed last check-in - type: 'STATE' - sub_type: 'RUNNING'
2021-08-26T18:42:16.030-0300    WARN    status/reporter.go:236  Elastic Agent status changed to: 'degraded'
2021-08-26T18:42:16.106-0300    INFO    cmd/enroll_cmd.go:682   Fleet Server - Missed last check-in
2021-08-26T18:42:16.107-0300    WARN    [tls]   tlscommon/tls_config.go:98      SSL/TLS verifications disabled.
2021-08-26T18:42:16.926-0300    INFO    cmd/enroll_cmd.go:414   Starting enrollment to URL: https://abc:8220/
2021-08-26T18:42:17.029-0300    INFO    cmd/run.go:189  Shutting down Elastic Agent and sending last events...
2021-08-26T18:42:17.029-0300    INFO    operation/operator.go:191       waiting for installer of pipeline 'default' to finish
2021-08-26T18:42:17.029-0300    INFO    process/app.go:181      Signaling application to stop because of shutdown: fleet-server--7.14.0
2021-08-26T18:42:47.076-0300    INFO    status/reporter.go:236  Elastic Agent status changed to: 'online'
2021-08-26T18:42:47.076-0300    INFO    log/reporter.go:40      2021-08-26T18:42:47-03:00 - message: Application: fleet-server--7.14.0[]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'
2021-08-26T18:42:47.076-0300    INFO    cmd/run.go:197  Shutting down completed.
2021-08-26T18:42:47.077-0300    INFO    [api]   api/server.go:66        Stats endpoint (/var/lib/elastic-agent/data/tmp/elastic-agent.sock) finished: accept unix /var/lib/elastic-agent/data/tmp/elastic-agent.sock: use of closed network connection
Error: fail to enroll: fail to execute request to fleet-server: 1 error occurred:
        * missing enrollment api key

1 Like

I have the same problem,
I am trying to install the fleet server, and keep getting remote server is not ready to accept connections, will retry in a moment

I downloaded the debian version of elastic agent, then Installed it

dpkg -i elastic-agent-7.14.0-amd64.deb

Then run the command :

 sudo elastic-agent enroll --url=https://X.X.X.X:8220 -f --fleet-server-es=https://Y.Y.Y.Y:9200 --fleet-server-service-token=************** --fleet-server-policy=******* --certificate-authorities=ca.crt --fleet-server-es-ca=elastic.crt --fleet-server-cert=fleet.crt --fleet-server-cert-key=fleet.key.key --enrollment-token=*****

Did find how to solve the problem ?

Best regards

I believe the issue is that you're not using absolute paths to the certificates and CA's. That is a known issue that Elastic Agent needs to solve, but if you switch to using absolute paths it should resolve your issue for now.

1 Like

Thanks for your answer @blaker ,

Yes I confirm, as when I used the absolute paths to the certificates and CA's the error changed to X509 certificate signed by unknown authority
I will dig more into this issue

Thanks again ^ ^

@TheHunter1 You need to add the --certificate-authorities paramater and give it the absolute path to the CA. The Elastic Agent needs the CA to be able to verify the certificate that you are giving the Fleet Server to start with.

@blaker , for me I have a cluster with 5 nodes: should I mention all the nodes in the --fleet-server-es parameter or just one of them ?

for me right now I am declaring just one master node , so my certificates are :

ca.crt : certificate authorities
Master-01.crt : Elastic node certificate
fleet-server.crt :
fleet-server.key

So to run the fleet server, I run this command :

sudo elastic-agent enroll --url=https://X.X.X.X:8220 -f --fleet-server-es=https://Y.Y.Y.Y:9200 --fleet-server-service-token=*********** --fleet-server-policy=******** --certificate-authorities=/home/hunter/elasticagent/ca.crt --fleet-server-es-ca=/home/hunter/elasticagent/MASTER-01.crt --fleet-server-cert=/home/hunter/elasticagent/fleet-server/fleet-server.crt --fleet-server-cert-key=/home/hunter/elasticagent/fleet-server/fleet-server.key --enrollment-token=******** 

But i still getting errors :

2021-09-01T15:19:07.778+0200	ERROR	status/reporter.go:236	Elastic Agent status changed to: 'error'
2021-09-01T15:19:07.778+0200	ERROR	log/reporter.go:36	2021-09-01T15:19:07+02:00 - message: Application: fleet-server--7.14.0[]: State changed to FAILED: Error - x509: certificate signed by unknown authority - type: 'ERROR' - sub_type: 'FAILED'
2021-09-01T15:19:08.434+0200	INFO	cmd/enroll_cmd.go:701	Fleet Server - Error - x509: certificate signed by unknown authority
2021-09-01T15:19:14.438+0200	INFO	cmd/enroll_cmd.go:706	Fleet Server - Error - x509: certificate signed by unknown authority

Even when I tried to run with --insecure option still have the same issue:

sudo elastic-agent enroll -f --fleet-server-es=https://X.X.X.X:9200 --fleet-server-service-token=******** --fleet-server-policy=******* --insecure

Knowing that I am in a debian machine, so already installed the elasticagent with the command :

dpkg -i elastic-agent-7.14.0-amd64.deb

and I have created my fleet-server certificate with the command :

bin/elasticsearch-certutil cert --name fleet-server --ca-cert config/certs/ca/ca.crt --ca-key config/certs/ca/ca.key --dns MachineName --ip X.X.X.X --pem

Fleet Server - Error - x509: certificate signed by unknown authority shows that the issue is with Fleet Server communicating with elasticsearch. The IP address you are giving in --fleet-server-es needs to match the DNS name that is given to the certificate that you used to get elasticsearch up and running. If you cannot do that using --insecure can help you bypass that issue for now just to see it all working. Obviously you don't want that in a production installation.

1 Like

So to try that, I run it in my dev machine which is running Elasticsearch from source (version 8) and I am getting new errors which means that I resolved the X509 certificate errors

The new errors are :

2021-09-01T16:53:31.440+0200	ERROR	status/reporter.go:236	Elastic Agent status changed to: 'error'
2021-09-01T16:53:31.440+0200	ERROR	log/reporter.go:36	2021-09-01T16:53:31+02:00 - message: Application: fleet-server--7.14.0[]: State changed to FAILED: Error - elastic fail 403:security_exception:action [indices:monitor/fleet/global_checkpoints] is unauthorized for user [elastic/fleet-server] on indices [.fleet-actions], this action is granted by the index privileges [monitor,manage,all] - type: 'ERROR' - sub_type: 'FAILED'
2021-09-01T16:53:32.137+0200	INFO	cmd/enroll_cmd.go:701	Fleet Server - Error - elastic fail 403:security_exception:action [indices:monitor/fleet/global_checkpoints] is unauthorized for user [elastic/fleet-server] on indices [.fleet-actions], this action is granted by the index privileges [monitor,manage,all]
2021-09-01T16:53:38.142+0200	INFO	cmd/enroll_cmd.go:706	Fleet Server - Error - elastic fail 403:security_exception:action [indices:monitor/fleet/global_checkpoints] is unauthorized for user [elastic/fleet-server] on indices [.fleet-actions], this action is granted by the index privileges [monitor,manage,all]
2021-09-01T16:53:41.440+0200	INFO	status/reporter.go:236	Elastic Agent status changed to: 'online'
2021-09-01T16:53:41.441+0200	INFO	log/reporter.go:40	2021-09-01T16:53:41+02:00 - message: Application: fleet-server--7.14.0[]: State changed to RESTARTING:  - type: 'STATE' - sub_type: 'STARTING'
2021-09-01T16:53:41.441+0200	INFO	log/reporter.go:40	2021-09-01T16:53:41+02:00 - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-09-01T16:53:41.441+0200	INFO	log/reporter.go:40	2021-09-01T16:53:41+02:00 - message: Application: fleet-server--7.14.0[]: State changed to RESTARTING: Restarting - type: 'STATE' - sub_type: 'STARTING'
2021-09-01T16:53:41.959+0200	INFO	log/reporter.go:40	2021-09-01T16:53:41+02:00 - message: Application: fleet-server--7.14.0[]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
2021-09-01T16:53:42.145+0200	INFO	cmd/enroll_cmd.go:701	Fleet Server - Starting
2021-09-01T16:53:42.460+0200	ERROR	status/reporter.go:236	Elastic Agent status changed to: 'error'
2021-09-01T16:53:42.460+0200	ERROR	log/reporter.go:36	2021-09-01T16:53:42+02:00 - message: Application: fleet-server--7.14.0[]: State changed to FAILED: Error - elastic fail 403:security_exception:action [indices:monitor/fleet/global_checkpoints] is unauthorized for user [elastic/fleet-server] on indices [.fleet-actions], this action is granted by the index privileges [monitor,manage,all] - type: 'ERROR' - sub_type: 'FAILED'
2021-09-01T16:53:43.146+0200	INFO	cmd/enroll_cmd.go:701	Fleet Server - Error - elastic fail 403:security_exception:action [indices:monitor/fleet/global_checkpoints] is unauthorized for user [elastic/fleet-server] on indices [.fleet-actions], this action is granted by the index privileges [monitor,manage,all]
2021-09-01T16:53:49.151+0200	INFO	cmd/enroll_cmd.go:706	Fleet Server - Error - elastic fail 403:security_exception:action [indices:monitor/fleet/global_checkpoints] is unauthorized for user [elastic/fleet-server] on indices [.fleet-actions], this action is granted by the index privileges [monitor,manage,all]

hello @blaker , yes you were right! thanks, i used the path to the certificate and managed to install it, but now the fleet server goes from offline to online several times and is not stabilized.
here are the latest logs:

{"log.level":"error","@timestamp":"2021-09-01T16:49:07.296Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T16:56:14.787Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T17:02:26.531Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T17:08:47.116Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T17:18:10.367Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T17:27:25.258Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T17:34:12.979Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T17:44:00.301Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T17:53:43.708Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T18:01:33.919Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T18:10:30.089Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T18:19:06.122Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T18:28:37.007Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T18:36:06.076Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T18:41:15.563Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T18:49:01.328Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-09-01T18:55:10.978Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":205},"message":"Could not communicate with fleet-server Checking API will retry, error: status code: 400, fleet-server returned an error: BadRequest","ecs.version":"1.6.0"}