I am super new to ealstic , and I followed the instruction (Quick start) to start a fleet server and enroll the policy . It is healthy about 20mins ? But when I restart Kibana , and after 20 mins , it became unhealthy , and requires me add another fleet server . What is happening ? What can I do ? Could really use some help !
!
Hi @Intruder,
Welcome to the community! Can you share which version of Elastic and Fleet you are using? Can you also share any warning or error messages in the logs?
Is this the log ? I have also downloaded the "elastic-agent-diagnostics-2024-04-28T10-43-48Z-00" but I can not attach files there
Thanks for sharing. That looks to be a connectivity issue between fleet server and Elasticsearch (401 unauthorized error on the agent).
It looks like the communication between fleet and Elasticsearch is blocked somehow. Do you have a proxy configured at all? What security settings have you enabled?
I dont have any proxy , all security is default , all I did from download is
1.enroll the kibana token ,kibana-setup
2.login 5601
3.Follow quick start added fleet server and policy
4.Add elastic defend to existing policy
5.Use kibana generate keys and added these stuff
6.added some rules.
Are there something wrong in my steps ?
In the elastic.yml I enabled xpacksecurity
Now I start to think this is the problem that is unhealthy
I am trying to fix it , any help is welcome
@Intruder it looks like your agent is not able to connect to Elasticsearch. Is you Elasticsearch instance up and healthy? Are you connection settings correct?
It works fine after I reinstalled the elastic , thanks for your time !
1 Like