Installing Fleet Server and enrolling Elastic Agents

1. Fleet Server #

The agents' control point.

Deployment options #

On Elastic Cloud, Fleet Server is provided (Integrations Server). Self-hosted, install it on a dedicated host (or several, behind a load balancer) with a policy containing the Fleet Server integration.

# Kibana › Fleet › Settings : Fleet Server hosts = https://fleet.exemple.fr:8220
# Kibana › Fleet › Add Fleet Server génère la commande, par exemple :
sudo ./elastic-agent install \
  --fleet-server-es=https://es.exemple.fr:9200 \
  --fleet-server-service-token=<jeton de service> \
  --fleet-server-policy=fleet-server-policy \
  --fleet-server-port=8220 \
  --certificate-authorities=/etc/pki/ca.crt \
  --fleet-server-cert=/etc/pki/fleet.crt --fleet-server-cert-key=/etc/pki/fleet.key

Certificates #

Common mistake: Using --insecure in production: the connection is no longer verified. Give agents the certificate authority (--certificate-authorities) and Fleet Server a valid certificate.

2. Enrolling agents #

Linux, Windows, Docker.

The steps #

Each policy has enrollment tokens. The agent presents the token once; it then receives its own API key and the associated policy.

Linux #

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-9.x.y-linux-x86_64.tar.gz
tar xzf elastic-agent-9.x.y-linux-x86_64.tar.gz && cd elastic-agent-9.x.y-linux-x86_64
sudo ./elastic-agent install --url=https://fleet.exemple.fr:8220 --enrollment-token=<jeton>
sudo elastic-agent status

Windows #

# PowerShell en administrateur
.\elastic-agent.exe install --url=https://fleet.exemple.fr:8220 --enrollment-token=<jeton>

Docker #

docker run -d --name elastic-agent --user root \
  -e FLEET_ENROLL=1 -e FLEET_URL=https://fleet.exemple.fr:8220 \
  -e FLEET_ENROLLMENT_TOKEN=<jeton> \
  docker.elastic.co/elastic-agent/elastic-agent:9.x.y

DEB and RPM packages #

Packages install the service without enrolling it: then run elastic-agent enroll and start the service.

Depending on the version: replace 9.x.y with your exact stack version: the agent version must not exceed Kibana's and Elasticsearch's.

3. Standalone mode #

Without Fleet.

Installing without enrollment #

sudo ./elastic-agent install --non-interactive   # répondre « non » à l'enrôlement
sudo vi /opt/Elastic/Agent/elastic-agent.yml        # politique exportée depuis Kibana ou écrite à la main
sudo elastic-agent restart && sudo elastic-agent status

Good practice: In Kibana, « Add agent › Run standalone » produces a complete elastic-agent.yml from a policy: an ideal starting point to version it.