Install Elastic Agents

edit

Restrictions

Note the following restrictions when installing Elastic Agent on your system:

  • You can install only a single Elastic Agent per host. Due to the fact that the Elastic Agent may read data sources that are only accessible by a superuser, Elastic Agent will therefore also need to be executed with superuser permissions.
  • You might need to log in as a root user (or Administrator on Windows) to run the commands described here. After the Elastic Agent service is installed and running, make sure you run these commands without prepending them with ./ to avoid invoking the wrong binary.
  • Running Elastic Agent commands using the Windows PowerShell ISE is not supported.

You have a few options for installing and managing an Elastic Agent:

Restrictions in Serverless

If you are using Elastic Agent with Elastic Cloud Serverless, note these differences from use with Elasticsearch Service and self-managed Elasticsearch:

  • The number of Elastic Agents that may be connected to an Elastic Cloud Serverless project is limited to 10 thousand.
  • The minimum supported version of Elastic Agent supported for use with Elastic Cloud Serverless is 8.11.0.

Minimum Requirements

edit

Minimum requirements have been determined by running the Elastic Agent on a GCP e2-micro instance (2vCPU/1GB). The Elastic Agent used the default policy, running the system integration and self-monitoring. During upgrades, double the disk space is required to store the new Elastic Agent binary. After the upgrade completes, the original Elastic Agent is removed from disk to free up the space.

CPU

Under 2% total, including all monitoring processes

Disk

1.7 GB

RSS Mem Size

400 MB

Adding integrations will increase the memory used by the agent and its processes.

Limiting CPU usage

edit

If you need to limit the amount of CPU consumption you can use the agent.limits.go_max_procs configuration option. This parameter limits the number of operating system threads that can be executing Go code simultaneously in each Go process. The agent.limits.go_max_procs option accepts an integer value not less than 0, which is the default value that stands for "all available CPUs".

The agent.limits.go_max_procs limit applies independently to the agent and each underlying Go process that it supervises. For example, if Elastic Agent is configured to supervise two Beats with agent.limits.go_max_procs: 2 in the policy, then the total CPU limit is six, where each of the three processes (one Elastic Agent and two Beats) may execute independently on two CPUs.

This setting is similar to the Beats max_procs setting. For more detail, refer to the GOMAXPROCS function in the Go runtime documentation.

To enable agent.limits.go_max_procs, run a Fleet API request from the Kibana Dev Tools console to override your current Elastic Agent policy and add the go_max_procs parameter. For example, to limit Go processes supervised by Elastic Agent to two operating system threads each, run:

PUT kbn:/api/fleet/agent_policies/<policy-id>
{
  "name": "<policy-name>",
  "namespace": "default",
  "overrides": {
    "agent": {
      "limits": {
        "go_max_procs": 2
      }
    }
  }
}