Fleetserver connectivity requirments when using an elasticsearch remote output

[mjmbischoff]

In addition to connectivity check the fleet server also creates apikeys using the service token. This is currently not documented well, moreover we currently lead users astray telling them to ignore the output health.

This PR only addresses the note, a more elaborate section should be added to guide the user.

Summary

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

[github-actions]

Vale Linting Results

Summary: 1 suggestion found

💡 Suggestions (1)

File	Line	Rule	Message
reference/fleet/remote-elasticsearch-output.md	122	Elastic.Wordiness	Consider using 'sometimes' instead of 'In some cases'.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• reference/fleet/remote-elasticsearch-output.md

[bmorelli25]

Thanks for the contribution! @vishaangelova can you please give this an editorial review.

[vishaangelova]

Thank you, @mjmbischoff!

After considering your addition at the end of the note, I think it might actually be better to move this out of the note and add it as a separate item under the Limitations section, for example like this:

* {{fleet-server}} must be able to reach the remote {{es}} cluster with a service token to create API keys for any {{agents}} that use the remote {{es}} output.

I hope I understood this correctly, but let me know if not or if I’m missing something.

a more elaborate section should be added to guide the user

Would you mind opening a docs issue with some more details about this?

[mjmbischoff]

I hope I understood this correctly, but let me know if not or if I’m missing something.

Yeah, I think that description is fine. I'm not too particular about the location. What does need some sort of update is the "In some cases, the remote {{es}} output used for {{agent}} data can be reached by the {{agent}}s but not by {{fleet-server}}. In those cases, you can ignore the resulting unhealthy state of the output and the associated Unable to connect error on the UI." part as it gives the illusion that there is a scenario where we can ignore the health, but authentication is always required.

Would you mind opening a docs issue with some more details about this?

That's actually quite tricky as I'm unsure who on the dev side of things is responsible for this part.

[vishaangelova]

I’ve updated the PR to include the suggested changes from the tech writer review (commit), so LGTM.

[mjmbischoff]

Changes are good.

We'll follow up with general documentation around how things are put together in other PR's, and this addresses the immediate concerns. Thank you @vishaangelova