[Fleet] Inconsistent Agent IDs are available on Kibana App under Fleet>agents and Discover Tab.

[dikshachauhan-qasource]

Kibana version:
7.12 BC3 Kibana Cloud environment

Host OS and Browser version:
Any, All

Preconditions

1. 7.12 BC3 Kibana Cloud environment should be available.

Build: 39134
Commit: 08417cbd6c15e4c866651a7dcdfeded58845206d
Artifact link : https://staging.elastic.co/7.12.0-96914cb5/summary-7.12.0.html

2. Default policy having system integration should exist.
3. few agents should be installed.

Steps to reproduce:

1. Login to Kibana cloud environment.
2. Go to fleet> Agents tab.
3. Select and Agent and navigate to Agent details page.
4. Observe, agent id is getting displayed and copy same.
5. Navigate to discover Tab.
6. Apply query below at search bar using copied agent id
   agent.id : "ec795bf0-7cc5-11eb-8585-5b9f507c66c5"

Actual Result:

• No results are getting displayed.
• Different agent ids are getting displayed on Discover TAB

Screenshot1:

Screenshot2:

[elasticmachine]

Pinging @elastic/fleet (Feature:Fleet)

[dikshachauhan-qasource]

@manishgupta-qasource Please review

[manishgupta-qasource]

Reviewed & Assigned to @EricDavisX

[kevinlog]

chatted with @muskangulati-qasource about a bug on the Endpoint admin side. #93738

See this comment: #93738 (comment)

We're seeing an inconsistent status because we're also getting a bad Agent ID reported by the Endpoint. It seems like the Agent sent a different ID down to the Endpoint than what it is reporting to the Fleet UI

[EricDavisX]

this is helpful, we had logged the same bug I think here: elastic/beats#24327 but this has great details! @michalpristas @blakerouse @ph this may be more impactful and widespread than we realized (the other issue was only seen on Windows 7) - can we make this a priority to investigate ?

we can close one as a dupe as soon as we're sure and have details, etc.

[michalpristas]

i have something here: elastic/beats#24387
let's see if that resolves this issue as well. i havent tested for this one

[michalpristas]

i checked with the fix above (from branch) and it seems it also fixes this issue

[EricDavisX]

this is excellent news ! @dikshachauhan-qasource please re-test in BC4 when it comes.

[amolnater-qasource]

Hi @EricDavisX
We have revalidated this issue on self managed 7.12.0 BC-4 Kibana environment and found this issue Not Fixed.

Build details:
Build: 39242
Commit: 99ac38d
Artifact Link used: https://staging.elastic.co/7.12.0-336ff10d/summary-7.12.0.html

Screenshots:

Further we validated the same issue on staging 7.12.0 BC-4 Kibana Cloud environment and observed inconsistent agent ids under Discover tab on using "agent.id:" filter.

Screenshots:

Please let us know if anything else is required.
Thanks
QAS

[michalpristas]

in your filter use logs-* or metrics-* we dont use anything else agent side.
to filter events from agent by id you need to use elastic_agent.id agent id will be ID of a beat itself generated during runtime.

[amolnater-qasource]

Hi @michalpristas
Thanks for clarifying the confusion, we are able to filter data with agent id using elastic_agent.id filter. Hence, closing this out.

Thanks
QAS