elastic / elastic/integrations
Support multiple interface device for Packetbeat
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
After this MR [packetbeat/config: allow multiple interfaces to be specified in the config #32732 ](https://github.com/elastic/beats/pull/32732 )was merged I am still not allowed to set multiple network interfaces to capture from in the `Network Packet Capture` integration.
So while packetbeat agent allows it specifically, I'm not allowed to set multiple interfaces through the fleet agent...
I'm using the `Network Packet Capture` integration through Kibana to specify network interfaces, trying to set an array like `['eth0','eth1']` causes the agent to fail to start with an error as noted below.
You can see from config output from running inspect command that the array correctly maps to a yaml list as seen in output below. While it correctly maps, the agent fails with error: `status: (FAILED) can not convert 'object' into 'string' accessing 'device'`
```
interface:
device:
- eth0
- eth1
```
Error seen at agent:
**sudo elastic-agent status**
```
┌─ fleet
│ └─ status: (HEALTHY) Connected
└─ elastic-agent
├─ status: (DEGRADED) 1 or more components/units in a failed state
└─ packet-default
├─ status: (HEALTHY) Healthy: communicating with pid '81489'
└─ packet-default-packet-network-3cdcbd39-daab-4ee9-8b8c-8683faa02d1a
└─ status: (FAILED) can not convert 'object' into 'string' accessing 'device'
```
**sudo elastic-agent version**
```
Binary: 8.17.5 (build: 259c4b95efcf436a2e9a6c06bca4316fc7e61a9d at 2025-04-09 11:43:56 +0000 UTC)
Daemon: 8.17.5 (build: 259c4b95efcf436a2e9a6c06bca4316fc7e61a9d at 2025-04-09 11:43:56 +0000 UTC
```
**Config**
**sudo elastic-agent inspect**
```
- data_stream:
namespace: dns
id: packet-network-3cdcbd39-daab-4ee9-8b8c-8683faa02d1a
meta:
package:
name: network_traffic
version: 1.33.0
name: dns-network_traffic-1
package_policy_id: 3cdcbd39-daab-4ee9-8b8c-8683faa02d1a
revision: 5
streams:
- data_stream:
dataset: network_traffic.dns
type: logs
fields:
_conf:
geoip_enrich: true
map_to_ecs: true
fields_under_root: true
id: packet-network_traffic.dns-3cdcbd39-daab-4ee9-8b8c-8683faa02d1a
interface:
device:
- eth0
- eth1
ports:
- 53
processors: null
type: dns
- data_stream:
dataset: network_traffic.icmp
type: logs
fields:
_conf:
geoip_enrich: true
map_to_ecs: true
fields_under_root: true
id: packet-network_traffic.icmp-3cdcbd39-daab-4ee9-8b8c-8683faa02d1a
interface:
device:
- eth0
- eth1
processors: null
type: icmp
type: packet
use_output: default
```
**Logs:**
```
sudo elastic-agent logs
{"log.level":"info","@timestamp":"2025-06-19T12:54:35.578Z","message":"Non-zero metrics in the last 30s","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"beat/metrics-monitoring","type":"beat/metrics"},"log":{"source":"beat/metrics-monitoring"},"monitoring":{"ecs.version":"1.6.0","metrics":{"beat":{"cgroup":{"cpuacct":{"total":{"ns":443795794}},"memory":{"mem":{"usage":{"bytes":529629184}}}},"cpu":{"system":{"ticks":1100,"time":{"ms":10}},"total":{"ticks":3150,"time":{"ms":40},"value":3150},"user":{"ticks":2050,"time":{"ms":30}}},"handles":{"limit":{"hard":4096,"soft":4096},"open":18},"info":{"ephemeral_id":"579446cb-0b75-44b8-89ff-815701df3f5f","uptime":{"ms":2820092},"version":"8.17.5"},"memstats":{"gc_next":78740792,"memory_alloc":35565352,"memory_total":185501696,"rss":190853120},"runtime":{"goroutines":78}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":6}},"output":{"events":{"active":0},"write":{"latency":{"histogram":{"count":75,"max":540,"mean":32.053333333333335,"median":27,"min":12,"p75":28,"p95":31.200000000000003,"p99":540,"p999":540,"stddev":59.172492107585114}}}},"pipeline":{"clients":6,"events":{"active":0},"queue":{"filled":{"bytes":0,"events":0,"pct":0},"max_bytes":0,"max_events":3200}}},"registrar":{"states":{"current":0}},"system":{"load":{"1":0.55,"15":0.26,"5":0.37,"norm":{"1":0.275,"15":0.13,"5":0.185}}}}},"log.logger":"monitoring","log.origin":{"file.line":192,"file.name":"log/log.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*reporter).logSnapshot"},"service.name":"metricbeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:35.633Z","message":"Non-zero metrics in the last 30s","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"http/metrics-monitoring","type":"http/metrics"},"log":{"source":"http/metrics-monitoring"},"log.logger":"monitoring","log.origin":{"file.line":192,"file.name":"log/log.go","function":"github.com/elastic/beats/v7/libbeat/monitoring/report/log.(*reporter).logSnapshot"},"service.name":"metricbeat","monitoring":{"ecs.version":"1.6.0","metrics":{"beat":{"cgroup":{"cpuacct":{"total":{"ns":445632815}},"memory":{"mem":{"usage":{"bytes":529764352}}}},"cpu":{"system":{"ticks":1090,"time":{"ms":10}},"total":{"ticks":3210,"time":{"ms":30},"value":3210},"user":{"ticks":2120,"time":{"ms":20}}},"handles":{"limit":{"hard":4096,"soft":4096},"open":21},"info":{"ephemeral_id":"0c462b45-6be3-40af-9957-d38dfcc66e52","uptime":{"ms":2820107},"version":"8.17.5"},"memstats":{"gc_next":79734288,"memory_alloc":36043560,"memory_total":199327616,"rss":193097728},"runtime":{"goroutines":96}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"module":{"running":9}},"output":{"events":{"acked":1,"active":0,"batches":1,"total":1},"read":{"bytes":176,"errors":1},"write":{"bytes":1537,"latency":{"histogram":{"count":92,"max":39,"mean":30.608695652173914,"median":31,"min":23,"p75":33,"p95":37.349999999999994,"p99":39,"p999":39,"stddev":3.422929465350361}}}},"pipeline":{"clients":9,"events":{"active":0},"queue":{"acked":1,"consumed":{"bytes":1942,"events":1},"filled":{"bytes":0,"events":0,"pct":0},"max_bytes":0,"max_events":3200,"removed":{"bytes":1942,"events":1}}}},"registrar":{"states":{"current":0}},"system":{"load":{"1":0.55,"15":0.26,"5":0.37,"norm":{"1":0.275,"15":0.13,"5":0.185}}}}},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:36.285Z","message":"'ca_trusted_fingerprint' set, looking for matching fingerprints","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"log-default","type":"log"},"log":{"source":"log-default"},"log.logger":"tls","log.origin":{"file.line":180,"file.name":"tlscommon/tls_config.go","function":"github.com/elastic/elastic-agent-libs/transport/tlscommon.trustRootCA"},"service.name":"filebeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:36.285Z","message":"CA certificate matching 'ca_trusted_fingerprint' found, adding it to 'certificate_authorities'","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"log-default","type":"log"},"log":{"source":"log-default"},"log.origin":{"file.line":207,"file.name":"tlscommon/tls_config.go","function":"github.com/elastic/elastic-agent-libs/transport/tlscommon.trustRootCA"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"tls","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:38.217Z","message":"'ca_trusted_fingerprint' set, looking for matching fingerprints","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"system/metrics-default","type":"system/metrics"},"log":{"source":"system/metrics-default"},"log.logger":"tls","log.origin":{"file.line":180,"file.name":"tlscommon/tls_config.go","function":"github.com/elastic/elastic-agent-libs/transport/tlscommon.trustRootCA"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:38.218Z","message":"CA certificate matching 'ca_trusted_fingerprint' found, adding it to 'certificate_authorities'","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"system/metrics-default","type":"system/metrics"},"log":{"source":"system/metrics-default"},"log.logger":"tls","log.origin":{"file.line":207,"file.name":"tlscommon/tls_config.go","function":"github.com/elastic/elastic-agent-libs/transport/tlscommon.trustRootCA"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:41.977Z","message":"'ca_trusted_fingerprint' set, looking for matching fingerprints","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"},"log":{"source":"filestream-monitoring"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"tls","log.origin":{"file.line":180,"file.name":"tlscommon/tls_config.go","function":"github.com/elastic/elastic-agent-libs/transport/tlscommon.trustRootCA"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:41.977Z","message":"CA certificate matching 'ca_trusted_fingerprint' found, adding it to 'certificate_authorities'","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-monitoring","type":"filestream"},"log":{"source":"filestream-monitoring"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"tls","log.origin":{"file.line":207,"file.name":"tlscommon/tls_config.go","function":"github.com/elastic/elastic-agent-libs/transport/tlscommon.trustRootCA"},"ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:46.642Z","message":"'ca_trusted_fingerprint' set, looking for matching fingerprints","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"beat/metrics-monitoring","type":"beat/metrics"},"log":{"source":"beat/metrics-monitoring"},"log.origin":{"file.line":180,"file.name":"tlscommon/tls_config.go","function":"github.com/elastic/elastic-agent-libs/transport/tlscommon.trustRootCA"},"service.name":"metricbeat","ecs.version":"1.6.0","log.logger":"tls","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-06-19T12:54:46.642Z","message":"CA certificate matching 'ca_trusted_fingerprint' found, adding it to 'certificate_authorities'","component":{"binary":"metricbeat","dataset":"elastic_agent.metricbeat","id":"beat/metrics-monitoring","type":"beat/metrics"},"log":{"source":"beat/metrics-monitoring"},"log.logger":"tls","log.origin":{"file.line":207,"file.name":"tlscommon/tls_config.go","function":"github.com/elastic/elastic-agent-libs/transport/tlscommon.trustRootCA"},"service.name":"metricbeat","ecs.version":"1.6.0","ecs.version":"1.6.0"}
```
Contributor guide
Assessment
This issue has not been assessed yet.