[Agent] when we enable Endpoint in Agent Policy, monitoring filebeat doesn't get sent the log path until Agent is re-started, reproducible only on x86 Windows so far

[EricDavisX]

When testing with the Build Candidate #5 from 7.11 - where we thought it was all fixed, we are seeing the exact same behavior as in #23599

I'm splitting this issue off as a potentially next level or more specific fix that relates to x86 is required

to sum up, I'm looking at the log files on the host and they exist, but nothing is showing as being ingested by the Monitor Filebeat in ES / Kibana.

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[EricDavisX]

before I even finished logging this, it looks like it started working. I think there was a repeated Agent 'error' state that may have caused it to continually re-start and not ever get to send logs. It seems to have stopped trying the re-start and now is doing ok. relates to the below error, maybe?

[elastic_agent][error] 2021-01-28T15:38:50-05:00: type: 'ERROR': sub_type: 'FAILED' message: Application: metricbeat--7.11.0[71e727b0-61a3-11eb-afd7-b56fbe435287]: State changed to FAILED: 1 error: 1 error: Error creating runner from config: 1 error: metricset 'system/load' not found

here is the total logging that we got, eventually:

win-7-x86-logs.log

another work-around is to re-start the Agent service itself and the logging will be picked up correctly, as shown in our testing.

[michalpristas]

system package is still on the old version?

[EricDavisX]

we have since discontinued x86 support so this can be closed with no impact or other follow up needed