elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.6k stars 8.21k forks source link

[Fleet] After migrating Agents, agents are duplicated #177049

Open gergoabraham opened 8 months ago

gergoabraham commented 8 months ago

Kibana version: v8.12.2 Elasticsearch version: v8.12.2 Server OS version: just used https://console.qa.cld.elstc.co/

Describe the bug: After following the steps of Migrate Fleet-managed Elastic Agents from one cluster to another, I ended up with duplicated Fleet Agents on the new cluster: an offline, 'migrated' one and a newly enrolled one from every one of them.

image

The offline Agents have the same id in the new cluster, as in the original cluster. However, when enrolling the same agents, they will receive a new id.

Consequences

The users won't be able to see history/logs for a given Agent, because every agent has a new id.

For example, Response actions history: the user cannot see the full history of an Endpoint, as it will be separated for the 'old' and the 'new' Endpoint.

Old, 'migrated' agent:

image

Newly enrolled agent after performing processes response action:

image

The whole history:

image

which goes crazy when user tries to filter by host:

image

Steps to reproduce: Just follow the docs.

elasticmachine commented 8 months ago

Pinging @elastic/fleet (Team:Fleet)

jlind23 commented 7 months ago

@gergoabraham thanks for reporting this but we know this is a limitation we have today. @nimarezainia is this something we should state in the docs?