[ES 8.5.3, 8.6.x]Elastic agent not deleting SQS message after processing.

[rubal033]

On using Elastic agent integration to monitor ELB logs (via s3-sqs setup). I am able to see ELB logs in Elasticsearch cluster but my SQS inflight messages are keep on increasing. Looks like agent is not able to delete all the messages in SQS. I have given all relevant permissions to the SQS queue and the agent (Ref: Getting AWS logs from S3 using Filebeat and the Elastic Stack | Elastic Blog). Also on looking at agent logs I found below errors which may be cause of same:

elastic-agent-logs.txt

For confirmed bugs, please report:

• Version: 8.5.3, 8.6.x
• Operating System: Centos 7, Rocky linux 9
• Discuss Forum URL: https://discuss.elastic.co/t/es-8-6-1-elastic-agent-not-deleting-sqs-message-after-processing/325372
• Steps to Reproduce:
  1. Install fleet server : https://www.elastic.co/guide/en/fleet/current/add-fleet-server-on-prem.html
  2. Add fleet agent : https://www.elastic.co/guide/en/fleet/current/install-fleet-managed-elastic-agent.html
  3. Add ELB integration : https://docs.elastic.co/integrations/aws/elb
  4. Monitor SQS.

[botelastic[bot]]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[therealdwright]

Not stale