search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.62k stars 8.22k forks source link

[Fleet] Elastic Agent integration is not installed when monitoring is enabled #157229

Open andrewkroh opened 1 year ago

andrewkroh commented 1 year ago

Kibana version: 8.7.0, 8.7.1, possibly earlier

Original install method (e.g. download page, yum, from source, etc.): Elastic Cloud

Describe the bug:

The Elastic Agent integration is not installed before monitoring data streams are created. This means default mappings are being applied and that dynamic fields are enabled. This could causes mapping explosions and data type conflicts depending on what is contained in the logs and metrics.

Steps to reproduce:

  1. Launch a new Elastic Cloud instance.
  2. Create agent policy with monitoring metrics/logs enabled.
  3. Enroll Agent.
  4. View that Filebeat (or other components) logs and metrics are populated in logs-elastic_agent.filebeat-default and metrics-elastic_agent.filebeat-default.
  5. Check the index template associated to those data streams. It will be the default logs and metrics templates instead of the templates contained in the elastic_agent package.
  6. Verify that the "Elastic Agent" package is not listed on the Installed Integrations tab.

Expected behavior:

The Elastic Agent integration would be installed either at first launch of Fleet or when the first Agent policy enables monitoring.

Any additional context:

Do not test this case using elastic-package. It has been explicitly configured to install elastic_agent via the kibana.yml. This has probably masked the bug from most integration developers.

elasticmachine commented 1 year ago

Pinging @elastic/fleet (Team:Fleet)