Feature Request: Separate configuration for grid-logstash output hosts and Fleet server hosts

[brazorfajeje]

Description

Currently, when adding a custom FQDN via Administration → Configuration → elasticfleet → config → server → custom_fqdn, the FQDN is added to both:

• Fleet server hosts (TCP/8220)
• Grid-logstash output hosts (TCP/5055)

This behavior doesn't accommodate deployments where a node runs Logstash but not Fleet server.

Use Case

In my distributed deployment, I have:

• Manager node: Fleet server + Logstash
• Receiver node: Logstash only (no Fleet server)

Current Fleet server hosts:

manager-hostname:8220
manager-fqdn:8220

Current grid-logstash outputs:

manager-hostname:5055
manager-fqdn:5055
receiver-hostname:5055

I need to add receiver-fqdn:5055 to the grid-logstash output for agents that resolve the receiver by FQDN, but I cannot add it to Fleet server hosts since the receiver doesn't run Fleet.

Current Limitation

Using custom_fqdn would add the receiver's FQDN to both lists, causing agents to attempt Fleet connections to a host that doesn't have Fleet server running.

Proposed Solution

Add a separate configuration option, for example:

• elasticfleet → config → outputs → custom_logstash_hosts

This would allow adding hosts exclusively to the grid-logstash output without affecting Fleet server hosts.

Alternatively, split custom_fqdn into two separate settings:

• custom_fleet_fqdn for Fleet server hosts (8220)
• custom_logstash_fqdn for Logstash output hosts (5055)

Environment

• Security Onion version: 2.4.190
• Deployment type: Distributed (Manager + Receiver + Search nodes)

Thank you for considering this enhancement!

[defensivedepth]

You can disable the auto-management of these features with the following config (meaning that you would have to manually add the URLs to the logstash and fleet config) - does this solve the issue for you?