elastic-agent

1

Elasticsearch Synthetics browser monitoring in kubernetes or containers

Posted on by jlim0930

Elastic’s Synthetics is still a beat feature but lately many are trying to use this but is having a hard time configuring it in containers and in kubernetes. I’ve started a simple stack deployment using my deploy-elastick8s.sh script and added tested this out. create the stack https://www.gooksu.com/2022/09/new-elastic-kubernetes-script-deploy-elastick8s-sh/ configure heartbeat followed the documents from https://www.elastic.co/guide/en/beats/heartbeat/current/running-on-kubernetes.html and used https://raw.githubusercontent.com/elastic/beats/8.7/deploy/kubernetes/heartbeat-kubernetes.yaml to create heartbeats. added browser monitoring using https://www.elastic.co/guide/en/beats/heartbeat/8.7/monitor-browser-options.html ran into some issues since browser monitoring can not be ran with root user need to change so that heartbeat can be ran as heartbeat user found https://github.com/elastic/beats/issues/29465#issuecomment-1024975901 to add the securityContext for spec and… Continue Reading →

0

Upgrading stack, fleet, elastic-agents in k8s running with ECK

Posted on by jlim0930

Lets say you are running your elastic stack in k8s with ECK and you need to upgrade your environment, how would you do it and in what order? ECK operator elasticsearch kibana fleet-server elastic-agent I will use my deploy-elastick8s.sh script to deploy a fleet deployment (elasticsearch + kibana + fleet server + elastic-agents running as daemonset). I will install ECK operator 2.7.0 and stack 8.6.2 and will upgrade to 8.7.0 > ./deploy-elastick8s.sh fleet 8.6.2 2.7.0 [DEBUG] jq found [DEBUG] docker found & running [DEBUG] kubectl found [DEBUG] openssl found [DEBUG] container image docker.elastic.co/elasticsearch/elasticsearch:8.6.2 is valid [DEBUG] ECK 2.7.0 version validated.… Continue Reading →

2

Fun things with Elastic’s Fleet server & elastic-agent

Posted on by jlim0930

There are many fun things we can do with the fleet server & elastic-agent To understand how to edit and change settings to do fun things with fleet server, first you have to understand how fleet server works with kibana & elasticsearch and elastic-agent. Fleet server itself is elastic-agent that runs in a server mode. It needs to communicate with both kibana and elasticsearch as well as elastic-agent. It uses elasticsearch as its config manager to store configurations so that it can configure & keep track of elastic-agents that is registered against it. Kibana is used to configure fleet server,… Continue Reading →

1

deploy-eck update 1

Posted on by jlim0930

OUTDATED – Please use this link for the new script and instructions https://www.gooksu.com/2022/09/new-elastic-kubernetes-script-deploy-elastick8s-sh/ I developed the deploy-eck.sh script to easily deploy the elastic stack in k8s to quickly test things. Did a quick update to the script. operator mode. Now you can run the script just to deploy the operator only and apply a trial license. You can develop your own test cases etc in this mode. If you work out of ~/eckstack and name your manifest files *.yaml when you run the deploy-eck.sh cleanup it will cleanup all of your items as well. > ./deploy-eck.sh cleanup ********** Cleaning up… Continue Reading →

1

Elastic Fleet Server & elastic-agent common troubleshooting

Posted on by jlim0930

Common troubleshooting items for any fleet & elastic-agent issues can be found on https://www.elastic.co/guide/en/fleet/current/fleet-troubleshooting.html however there are a few items that I would like to add. Whitespaces When you start the elastic-agent on an endpoint and even if you have everything configured for your elastic-agent, the right policy, integrations, etc however no data is going into elasticsearch. The most common issue is that there is something wrong with your fleet settings. This can be edited from kibana -> fleet -> settings. Either your ES endpoint / Fleet server endpoint / Advanced YAML settings are wrong or there might even be… Continue Reading →

4

Fleet server with logstash output – elastic-agent

Posted on by jlim0930

I think one of the biggest issue with fleet and elastic-agent was that it was limited on the outputs so if you had tons and tons of elastic-agents in the wild it would all connect back to your elasticsearch and can overwhelm the cluster. Starting 8.2 of elasticsearch logstash output type was introduced.. it is still in BETA at this time but I just tried it and it worked very nicely! The steps to setup the logstash output is listed on https://www.elastic.co/guide/en/fleet/8.2/secure-logstash-connections.html but I wanted to try it out and document it. Install & configure logstash Install yum install logstash-8.2.2… Continue Reading →

2

Updated deploy-elastic script – version 8

Posted on by jlim0930

Last update to version 7 is listed here The original post for the deploy-elastic.sh script is here. Changes: fully tested from 6.x-8.2(will most likely work with future 8.x versions) decoupled non stack modes from checking versions so that you can add the secondary components like monitoring/fleet/apm/enterprise-search using different version than the stack version. Just install the stack first then install the secondary components with different versions. Secondary versions can not be higher than the stack version. This will allow you to test using different versions fleet setting is now auto-populated. The script will gather the machines external IP and set… Continue Reading →

12

Fleet server with elasticsearch in docker container

Posted on by jlim0930

UPDATE – 3/30/2022: another 8.1.x update to automatically populate the CA trusted fingerprint and the Advanced YAML settings to add the generated ca.crt onto fleet for easier use – Please go to the bottom of the article for an explaination UPDATE: 8.1.0 release introduced some changes where the default policies are no longer created on default and you will need to manually create it. I will add the steps to the end of the document Fleet server in docker container Fleet & Fleet server was released as of 7.14.0 and it uses the elastic-agent as a single, unified way to… Continue Reading →