IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Manage your Elastic Agents Run Elastic Agent »

› ›

Install Elastic Agent

edit

Install Elastic Agent

edit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

Download and install Elastic Agent on each system you want to monitor.

To download and install Elastic Agent, use the commands that work with your system:

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-amd64.deb
sudo dpkg -i elastic-agent-7.9.3-amd64.deb

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-x86_64.rpm
sudo rpm -vi elastic-agent-7.9.3-x86_64.rpm

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-darwin-x86_64.tar.gz
tar xzvf elastic-agent-7.9.3-darwin-x86_64.tar.gz

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-linux-x86_64.tar.gz
tar xzvf elastic-agent-7.9.3-linux-x86_64.tar.gz

We recommend that you use the DEB or RPM distribution, instead of the tarball, to ensure that Elastic Agent restarts automatically if the system is rebooted.

Download the Elastic Agent Windows zip file from the downloads page.
Extract the contents of the zip file into C:\Program Files.
Rename the elastic-agent-<version>-windows directory to Elastic-Agent.

Manually install Elastic Agent as a service on macOS

edit

If you want Elastic Agent to be persistent after restarts, you need to install and run it as a service. Improved support for running Elastic Agent as a service on macOS will be available in a future release.

Create a file called co.elastic.agent.plist in /Library/LaunchDaemons/ and copy the following settings into the new file:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>co.elastic.agent</string>
    <key>ProgramArguments</key>
    <array>
        <string>/Library/Elastic/Agent/elastic-agent</string>
        <string>run</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>WorkingDirectory</key>
    <string>/Library/Elastic/Agent</string>
    <key>UserName</key>
    <string>root</string>
    <key>KeepAlive</key>
    <true/>
    <key>ThrottleInterval</key>
    <integer>15</integer>
    <key>EnableTransactions</key>
    <false/>
    <key>ExitTimeOut</key>
    <integer>60</integer>
</dict>
</plist>

Change the ownership of the .plist file to root:

sudo chown root:wheel /Library/LaunchDaemons/co.elastic.agent.plist

Create the path /Library/Elastic/Agent/.
Copy the files that you extracted from elastic-agent-7.9.3-darwin-x86_64.tar.gz into /Library/Elastic/Agent/.
Start the agent as a service:
```
sudo launchctl load -w /Library/LaunchDaemons/co.elastic.agent.plist
```
This command starts the agent, so do not attempt to use the run command.

To stop and remove the service:

Stop the service and remove the property list file:

sudo launchctl unload -w /Library/Launchdaemons/co.elastic.agent.plist
rm /Library/Launchdaemons/co.elastic.agent.plist

Unenroll the agent from Fleet.

Unenrolling the agent should stop Elastic Agent and any other programs started by the agent, such as Elastic Endpoint Security and data shippers.
If necessary, manually kill the elastic-agent process and any other processes started by the agent.

« Manage your Elastic Agents Run Elastic Agent »