Sensor Logstash Output Not Using Receiver Node IP Addresses

[AmusedNetwork]

Hi,

I have an issue with outputting from sensor nodes to receiver nodes as they are referenced by hostname instead of IP address.

Setup

Version: 2.4.100

I have a distributed setup with one sensor, one manager, two receivers, and two search nodes. They are all on the same, flat network (172.18.58.0/24). Each node has 32 GB RAM, and 16 vCPUs, with the exception of the two search nodes which both have 24 vCPUs.

Note: I installed this in "Air Gap" mode, and left the DNS setting at its default (8.8.8.8, 8.8.4.4) and gateway to the first IP address in my subnet (172.18.58.1), although no gateway exists currently.

Receiver question

When I add a receiver node, the sensor node does not output events to the receiver. The manager continues to receive all events.

The manager node is listed as a Logstash output in Elastic Fleet settings as two entries - one by IP, and the other by hostname.

I can temporarily fix this issue by changing the fleet manager settings to set the Logstash output to receiver's IP addresses. However these seem to be reset to the default (hostname) shortly after. I tried changing the /etc/hosts file on my sensor node, but at least when I tried this, I received no events to my receivers (although I was also not receiving events on the manager either at this time).

Is there any workaround short of creating a DNS server and changing resolv.conf? Can I make the Logstash output use IP address rather than hostname similar to how the manager outputs show up?

Upon further searching I see the same issue here: #11909 (comment), can this be added to the main install?

Extra Questions

I have a few other things I would like to ask - should I add these as separate discussions?:

• I'm experiencing long start times for so-firewall-minion after the manager node restarts. The initial startup takes 3-5 minutes, while subsequent invocations are much faster (5-10 seconds). Is this normal behaviour?
• I am getting approximately 10k-15k EPS across both of my Elasticsearch VMs. This is the same as when I had just one search node. Would additional receivers increase this - the Redis queue on the manager quickly grows currently.
• I'm encountering a problem with SCSI CDROM devices in my libvirt setup. The CDROM hangs on 'Basic Target' during the initial boot, but SATA devices work correctly. Has anyone else experienced this issue?
• If I add an extra Logstash output, and filter this in the main pipeline, will this filter out events destined for Elasticsearch?

Thanks

[JhonShell]

Hi,
please add this option to the manager and a new entry will be added to receive log on the receiver