Elastic fleet config Custom FQDN does not apply to logstash

[networklord]

Version

2.4.90

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

200

Storage for /nsm

200

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Per documentation :

https://docs.securityonion.net/en/2.4/elastic-fleet.html when you add custom URL it should also apply to logstash. But only changes Fleet server Hosts

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[JhonShell]

hi there,
Go to the manager and enable advance mode, go to fleet option and add the Logstash name server, then after 10 minute it should apply the FQDN.

[networklord]

Unfortunately it does not show up :

[JhonShell]

Remember it do not show up automatically, it takes around 10 to 30 to show up, try to restart the service, also press the sync button.

[JhonShell]

I see that you are putting an Ip not a name, it might be the issue, try to add it the hosts files if a DNS entry is not created.

[networklord]

I have tried to add some DNS name but still does not show under Outputs

[JhonShell]

Hello,
in order to add the output entry for Logstash the configuration below have to be set to false, then all the logs would be redirected to the dns added and the manager would reject the Logstash log, after a few minutes you should see the entry added.

[networklord]

Hi,

Thanks for answer, i will proceed with Standalone Fleet server, dont wanna mess with options