-
Notifications
You must be signed in to change notification settings - Fork 524
ti_abusech: Increase memory for agentless deployment #13760
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
cc @kcreddy |
|
andrewkroh
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
What was the test methodology? Upload package zip file to kibana via API?
Yes @andrewkroh. |
|
Package ti_abusech - 2.10.0 containing this change is available at https://epr.elastic.co/package/ti_abusech/2.10.0/ |




Proposed commit message
Checklist
changelog.ymlfile.Screenshots
Before:
Agent logs (input
STOPPEDwith exit code -1){"log.level":"info","@timestamp":"2025-04-30T16:49:03.363Z","message":"registering","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"id":"cel-ti_abusech.url-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67::https://urlhaus.abuse.ch/downloads/json","key":"cel-ti_abusech_url-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67::https://urlhaus_abuse_ch/downloads/json","uuid":"16c02628-e208-4b43-a8ff-cc3eedad4d8f","ecs.version":"1.6.0","log.logger":"metric_registry","log.origin":{"file.line":63,"file.name":"inputmon/input.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/inputmon.NewInputRegistry"},"service.name":"filebeat","input_type":"cel","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:03.366Z","message":"process repeated request","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"id":"cel-ti_abusech.url-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","input_url":"https://urlhaus.abuse.ch/downloads/json","ecs.version":"1.6.0","log.origin":{"file.line":225,"file.name":"cel/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1"},"service.name":"filebeat","input_source":"https://urlhaus.abuse.ch/downloads/json","log.logger":"input.cel","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2025-04-30T16:49:03.608Z","message":"single event object returned by evaluation","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"service.name":"filebeat","id":"cel-ti_abusech.malwarebazaar-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","input_source":"https://mb-api.abuse.ch/api/v1/","ecs.version":"1.6.0","log.logger":"input.cel","log.origin":{"file.line":407,"file.name":"cel/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1"},"input_url":"https://mb-api.abuse.ch/api/v1/","event":{"error":{"code":"402","id":"402 Payment Required","message":"POST:{\n \"query_status\": \"ratelimited\",\n \"msg\": \"Your request has been rate-limited. Please visit https:\\/\\/abuse.ch\\/rate-limit\\/ for more information.\"\n}"}},"ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2025-04-30T16:49:03.615Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67 (HEALTHY->DEGRADED): single event error object returned by evaluation: {\"error\":{\"code\":\"402\",\"id\":\"402 Payment Required\",\"message\":\"POST:{\\n \\\"query_status\\\": \\\"ratelimited\\\",\\n \\\"msg\\\": \\\"Your request has been rate-limited. Please visit https:\\\\/\\\\/abuse.ch\\\\/rate-limit\\\\/ for more information.\\\"\\n}\"}}","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"HEALTHY"},"unit":{"id":"cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","type":"input","state":"DEGRADED","old_state":"HEALTHY"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:04.860Z","message":"add_cloud_metadata: hosting provider type not detected.","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.logger":"add_cloud_metadata","log.origin":{"file.line":100,"file.name":"add_cloud_metadata/add_cloud_metadata.go","function":"github.com/elastic/beats/v7/libbeat/processors/add_cloud_metadata.(*addCloudMetadata).init.func1"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:04.899Z","message":"Connecting to backoff(elasticsearch(https://0c0a9b03c334490ebd8bd527d95014f8.us-central1.gcp.cloud.es.io:443))","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"publisher_pipeline_output","log.origin":{"file.line":138,"file.name":"pipeline/client_worker.go","function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:05.008Z","message":"Attempting to connect to Elasticsearch version 8.18.0 (default)","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"esclientleg","log.origin":{"file.line":323,"file.name":"eslegclient/connection.go","function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.(*Connection).Ping"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:05.324Z","message":"Connection to backoff(elasticsearch(https://0c0a9b03c334490ebd8bd527d95014f8.us-central1.gcp.cloud.es.io:443)) established","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.logger":"publisher_pipeline_output","log.origin":{"file.line":146,"file.name":"pipeline/client_worker.go","function":"github.com/elastic/beats/v7/libbeat/publisher/pipeline.(*netClientWorker).run"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:30.711Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":687},"message":"Component state changed cel-default (HEALTHY->STOPPED): Suppressing FAILED state due to restart for '28' exited with code '-1'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STOPPED","old_state":"HEALTHY"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:30.712Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67 (DEGRADED->STOPPED): Suppressing FAILED state due to restart for '28' exited with code '-1'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STOPPED"},"unit":{"id":"cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","type":"input","state":"STOPPED","old_state":"DEGRADED"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:30.712Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed cel-default (HEALTHY->STOPPED): Suppressing FAILED state due to restart for '28' exited with code '-1'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STOPPED"},"unit":{"id":"cel-default","type":"output","state":"STOPPED","old_state":"HEALTHY"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:31.714Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":667},"message":"Spawned new component cel-default: Starting: spawned pid '68'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STARTING"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:31.714Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":674},"message":"Spawned new unit cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67: Starting: spawned pid '68'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STARTING"},"unit":{"id":"cel-default-cel-ti_abusech-1c57b81b-ee89-4fe9-ad66-bc5dd6af7b67","type":"input","state":"STARTING"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:31.714Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":674},"message":"Spawned new unit cel-default: Starting: spawned pid '68'","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"STARTING"},"unit":{"id":"cel-default","type":"output","state":"STARTING"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:31.809Z","message":"Home path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components] Config path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components] Data path: [/agentless/data/run/cel-default] Logs path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components/logs]","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.origin":{"file.line":1082,"file.name":"instance/beat.go","function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-04-30T16:49:31.810Z","message":"Beat ID: f2f6a96b-e3c6-490b-9722-453a4c35a4a9","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.origin":{"file.line":1090,"file.name":"instance/beat.go","function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}Multiple errors inside same interval due to input restarts

After:
Agent logs (input doesn't get
STOPPED){"log.level":"info","@timestamp":"2025-05-02T06:08:55.169Z","message":"BeatV2Manager.unitListen UnitChanged.ID(filestream-monitoring), UnitChanged.Type(added), UnitChanged.Trigger(4): added/feature_change_triggered","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"},"log":{"source":"filestream-monitoring"},"ecs.version":"1.6.0","log.logger":"centralmgmt.V2-manager","log.origin":{"file.line":506,"file.name":"management/managerV2.go","function":"github.com/elastic/beats/v7/x-pack/libbeat/management.(*BeatV2Manager).unitListen"},"service.name":"filebeat","ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2025-05-02T06:08:55.183Z","message":"single event object returned by evaluation","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"input_source":"https://mb-api.abuse.ch/api/v1/","event":{"error":{"code":"402","id":"402 Payment Required","message":"POST:{\n \"query_status\": \"ratelimited\",\n \"msg\": \"Your request has been rate-limited. Please visit https:\\/\\/abuse.ch\\/rate-limit\\/ for more information.\"\n}"}},"log.logger":"input.cel","id":"cel-ti_abusech.malwarebazaar-a4ca8426-13b0-4a46-a4bf-c73192e15d8d","input_url":"https://mb-api.abuse.ch/api/v1/","ecs.version":"1.6.0","log.origin":{"file.line":407,"file.name":"cel/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1"},"service.name":"filebeat","ecs.version":"1.6.0"} {"log.level":"warn","@timestamp":"2025-05-02T06:08:55.183Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed cel-default-cel-ti_abusech-a4ca8426-13b0-4a46-a4bf-c73192e15d8d (HEALTHY->DEGRADED): single event error object returned by evaluation: {\"error\":{\"code\":\"402\",\"id\":\"402 Payment Required\",\"message\":\"POST:{\\n \\\"query_status\\\": \\\"ratelimited\\\",\\n \\\"msg\\\": \\\"Your request has been rate-limited. Please visit https:\\\\/\\\\/abuse.ch\\\\/rate-limit\\\\/ for more information.\\\"\\n}\"}}","log":{"source":"elastic-agent"},"component":{"id":"cel-default","state":"HEALTHY"},"unit":{"id":"cel-default-cel-ti_abusech-a4ca8426-13b0-4a46-a4bf-c73192e15d8d","type":"input","state":"DEGRADED","old_state":"HEALTHY"},"ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2025-05-02T06:08:55.209Z","message":"single event object returned by evaluation","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"cel-default","type":"cel"},"log":{"source":"cel-default"},"log.logger":"input.cel","log.origin":{"file.line":407,"file.name":"cel/input.go","function":"github.com/elastic/beats/v7/x-pack/filebeat/input/cel.input.run.func1"},"input_url":"https://threatfox-api.abuse.ch/api/v1/","ecs.version":"1.6.0","service.name":"filebeat","id":"cel-ti_abusech.threatfox-a4ca8426-13b0-4a46-a4bf-c73192e15d8d","input_source":"https://threatfox-api.abuse.ch/api/v1/","event":{"error":{"code":"402","id":"402 Payment Required","message":"POST https://threatfox-api.abuse.ch/api/v1:{\n \"query_status\": \"ratelimited\",\n \"msg\": \"Your request has been rate-limited. Please visit https:\\/\\/abuse.ch\\/rate-limit\\/ for more information.\"\n}"}},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.366Z","message":"Applying performance preset 'balanced': {\n \"bulk_max_size\": 1600,\n \"compression_level\": 1,\n \"idle_connection_timeout\": \"3s\",\n \"queue\": {\n \"mem\": {\n \"events\": 3200,\n \"flush\": {\n \"min_events\": 1600,\n \"timeout\": \"10s\"\n }\n }\n },\n \"worker\": 1\n}","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"service.name":"metricbeat","ecs.version":"1.6.0","log.logger":"elasticsearch","log.origin":{"file.line":57,"file.name":"elasticsearch/elasticsearch.go","function":"github.com/elastic/beats/v7/libbeat/outputs/elasticsearch.makeES"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.367Z","message":"elasticsearch url: https://2c3f6df68ecb40bb842c9457e68fa9c3.us-central1.gcp.cloud.es.io:443","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"ecs.version":"1.6.0","log.logger":"esclientleg","log.origin":{"file.line":132,"file.name":"eslegclient/connection.go","function":"github.com/elastic/beats/v7/libbeat/esleg/eslegclient.NewConnection"},"service.name":"metricbeat","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.375Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed http/metrics-monitoring-metrics-monitoring-agent (STARTING->HEALTHY): Healthy","log":{"source":"elastic-agent"},"component":{"id":"http/metrics-monitoring","state":"HEALTHY"},"unit":{"id":"http/metrics-monitoring-metrics-monitoring-agent","type":"input","state":"HEALTHY","old_state":"STARTING"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.375Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":705},"message":"Unit state changed http/metrics-monitoring (STARTING->HEALTHY): Healthy","log":{"source":"elastic-agent"},"component":{"id":"http/metrics-monitoring","state":"HEALTHY"},"unit":{"id":"http/metrics-monitoring","type":"output","state":"HEALTHY","old_state":"STARTING"},"ecs.version":"1.6.0"} {"log.level":"error","@timestamp":"2025-05-02T06:08:55.375Z","message":"Error fetching data for metricset http.json: error making http request: Get \"http://unix/stats\": dial unix /agentless/data/tmp/Hk6rvk9TDibMPcDvpl0jkLE-qDsHWVYL.sock: connect: no such file or directory","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"log.origin":{"file.line":333,"file.name":"module/wrapper.go","function":"github.com/elastic/beats/v7/metricbeat/mb/module.(*metricSetWrapper).handleFetchError"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.615Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":667},"message":"Spawned new component beat/metrics-monitoring: Starting: spawned pid '91'","log":{"source":"elastic-agent"},"component":{"id":"beat/metrics-monitoring","state":"STARTING"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.615Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":674},"message":"Spawned new unit beat/metrics-monitoring: Starting: spawned pid '91'","log":{"source":"elastic-agent"},"component":{"id":"beat/metrics-monitoring","state":"STARTING"},"unit":{"id":"beat/metrics-monitoring","type":"output","state":"STARTING"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.615Z","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/application/coordinator.(*Coordinator).watchRuntimeComponents","file.name":"coordinator/coordinator.go","file.line":674},"message":"Spawned new unit beat/metrics-monitoring-metrics-monitoring-beats: Starting: spawned pid '91'","log":{"source":"elastic-agent"},"component":{"id":"beat/metrics-monitoring","state":"STARTING"},"unit":{"id":"beat/metrics-monitoring-metrics-monitoring-beats","type":"input","state":"STARTING"},"ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.731Z","message":"Home path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components] Config path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components] Data path: [/agentless/data/run/beat/metrics-monitoring] Logs path: [/usr/share/elastic-agent/data/elastic-agent-1c9cf2/components/logs]","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"beat/metrics-monitoring","type":"beat/metrics"},"log":{"source":"beat/metrics-monitoring"},"log.origin":{"file.line":1082,"file.name":"instance/beat.go","function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"} {"log.level":"info","@timestamp":"2025-05-02T06:08:55.734Z","message":"Beat ID: a937f5a7-e07b-4160-aa92-35ac89ee72bf","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"beat/metrics-monitoring","type":"beat/metrics"},"log":{"source":"beat/metrics-monitoring"},"service.name":"metricbeat","ecs.version":"1.6.0","log.origin":{"file.line":1090,"file.name":"instance/beat.go","function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(*Beat).configure"},"ecs.version":"1.6.0"}Single error per interval because of no input restarts
