Hello, I upgraded our ELK instance to 6.5.1 and installed the Windows Filebeat 6.5.1 agent on a Windows system I wanted to monitor. All seemed to be running fine. I decided to try out the new Filebeat centralized management feature and enrolled the Windows Filebeat client on the server. The Windows client was able to enroll fine, but no further contact was made, and configurations were not updated as expected. Upon further investigation, I saw this logged on the client: error retriving new configurations, will use cached ones: Beat "xxxxxxxx" not found. I then noticed the UUID stored in the meta.json file is different from the one shown in Central Management Console. When I updated the meta.json file with the UUID listed in Central Management and restarted services, all seemed to work as expected. I was able to reproduce this behavior consistently on six systems I tried to enroll in Central Management.
I am able to work around this error by manually updating the UUID in meta.json on the client system. It is an inconvenience but not critically impactful. However, I think I may have found a couple bugs in the new version of the Windows Filebeat client. There appears to be an inconsistent UUID being assigned to server and client, as well as the misspelling of 'retrieving' in the error log.