Symptom
The Elasticsearch API Source in Cribl Stream reports zero events when onboarding Elastic Agent 9.x. TCP connectivity to the workers on port 9200 is confirmed via netstat and curl, but no data appears in the source. The Elastic Agent logs show events with no errors.
Environment
- Cribl Stream
- Hyrbid (or on-prem) workers
- Elasticsearch API source
- Elastic Agent 9.x
Resolution
- Navigate to the Elasticsearch API Source configuration in Cribl Stream.
- Under Advanced Settings, set API Version to Custom.
- In the Custom API Version expression box, modify the version.number value that matches the Elastic Agent's version. For example, for Elastic Agent 9.2.5:
{ "name": "AzU84iL", "cluster_name": "cribl", "cluster_uuid": "Js6_Z2VKS3KbfRSxPmPbaw", "version": { "number": "9.2.5", "build_type": "tar", "build_hash": "bca0c8d", "build_date": "2019-10-16T06:19:49.319352Z", "build_snapshot": false, "lucene_version": "9.7.2", "minimum_wire_compatibility_version": "7.17.0", "minimum_index_compatibility_version": "7.0.0" }, "tagline": "You Know, for Search" } - Ensure TLS is enabled on the source if the Elastic Agent output configuration has SSL/TLS enabled.
- Save and Commit and Deploy.
Cause
Cribl's Elasticsearch API Source defaults to API version 8.3.2 or 6.8.4. When an Elastic Agent 9.x connects, the version handshake fails because the agent does not recognize the older version response, so the only path is to set a Custom API Version on the Cribl side.
This issue is compounded when TLS and the API version are changed at different times during troubleshooting, resulting in a state where both settings are never correct simultaneously. For example:
- TLS enabled + wrong API version = version mismatch, no data
- TLS disabled + wrong API version = version mismatch + potential TLS mismatch, no data
- TLS disabled + correct API version = TLS mismatch (if agent expects HTTPS), no data
- TLS enabled + correct API version = working configuration
Last Validated
4.15.1