Lab 1: Build an Elastic lab with Fleet Server and a first agent

What you will learn in this TP

• Start Elasticsearch and Kibana with Fleet preconfigured
• Create the Fleet Server service token
• Enroll an agent in a policy
• Check the data in Kibana

Introduction #

What you will learn in this section

• Start Elasticsearch and Kibana with Fleet preconfigured
• Create the Fleet Server service token
• Enroll an agent in a policy
• Check the data in Kibana

Context. Your team wants to replace its Beats with Elastic Agent. You build a complete lab to validate the Fleet chain end to end.

Prerequisites: Docker and Docker Compose, 4 GB of free RAM  ·  Estimated time: 60 min

Hands-on #

Guided steps, with their solution.

1. 1. The lab files

   Why? Fleet is preconfigured in kibana.yml: output, Fleet Server host and policies are created at startup, with no clicks.

   Create a folder, then the .env, kibana.yml and compose.yaml files. Replace the version with the latest available 9.x version.

2. 2. Start Elasticsearch and Kibana

   Why? Kibana connects with the kibana_system user, whose password must be set first.

3. 3. Fleet Server

   Why? Fleet Server authenticates to Elasticsearch with a dedicated service token, never with the elastic account.

4. 4. Enroll the agent

   Why? Each policy has its own enrollment token: the agent joins « Lab policy » and receives the System integration.

5. 5. Check

   In Kibana › Fleet › Agents, the lab-agent agent must be Healthy. Then check the data streams.

Difficulty level : ●●○○○ (2/5)