使用8.11.1版本的elastic时,fleet管理的agent代理看不到日志。
如上图所示,我集成了基础的三个组件:system、fleet-server、apm。我的elastic是在内网环境使用,并配置了TLS安全。在下载了elastic-agent的安装包elastic-agent-8.11.1-linux-x86_64.tar.gz后,我进行解压后并未对解压文件中的elastic-agent.yml、filebeat和metricbeat再进行配置,使用的是默认配置,安装命令为:
sudo ./elastic-agent install --url=https://10.150.3.17:8220 \
--fleet-server-es=https://10.150.3.17:9200 \
--fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE3MTA5MDAxNTM2MzI6RVdFZkU1c2VUNVNDeUdRQnUtaVdZQQ \
--fleet-server-policy=cb94f700-e5db-11ee-9078-c1a49bee68db \
--certificate-authorities=/home/elastic/downloads/beats/elastic-agent/fleet-server/ca.crt \
--fleet-server-es-ca=/home/elastic/downloads/beats/elastic-agent/fleet-server/http.crt \
--fleet-server-cert=/home/elastic/downloads/beats/elastic-agent/fleet-server/fleet-server.crt \
--fleet-server-cert-key=/home/elastic/downloads/beats/elastic-agent/fleet-server/fleet-server.key \
--fleet-server-port=8220 \
--fleet-server-es-insecure \
--insecure
查看服务日志错误信息为:
{"log.level":"error","@timestamp":"2024-03-21T09:32:04.443Z","message":"elastic-agent-client error: \
rpc error: code = Canceled desc = context canceled","component": \
{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"}, \
"log":{"source":"filestream-monitoring"},"log.logger":"centralmgmt.V2-manager", \
"log.origin":{"file.line":448,"file.name":"management/managerV2.go"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}