Install Fleet-managed Elastic Agents

edit

These steps assume you’re running a fresh installation. If Elastic Agent is already running on your system, and you want to upgrade to a new version, see Upgrade Elastic Agents.

If you’re a new user, instead of following the steps described here, read our quick start guides:

Prerequisites

edit
  • Kibana user with All privileges on Fleet and Integrations. Since many Integrations assets are shared across spaces, users need the Kibana privileges in all spaces.
  • Fleet Server running in a location accessible to Elastic Agent. Elastic Agent must have a direct network connection to Fleet Server and Elasticsearch. If you’re using our hosted Elasticsearch Service on Elastic Cloud, Fleet Server is already available as part of the Integrations Server.
  • Internet connection for Kibana to download integration packages from the Elastic Package Registry. Make sure the Kibana server can connect to https://epr.elastic.co on port 443. If your environment has network traffic restrictions, there are ways to work around this requirement. See Air-gapped environments for more information.
  • If you’re running Elastic Agent 7.9 or earlier, stop the agent and manually remove it from your host.

Installation steps

edit

You can install only a single Elastic Agent per host.

To install an Elastic Agent and enroll it in Fleet:

  1. In Kibana, go to Fleet > Agents, and click Add agent.
  2. In the Add agent flyout, select an existing agent policy or create a new one. If you create a new policy, Fleet generates a new Fleet enrollment token.
  3. Make sure Enroll in Fleet is selected.
  4. Download, install, and enroll the Elastic Agent on your host by selecting your host operating system and following the Install Elastic Agent on your host step.

    Add agent flyout in Kibana

After about a minute, the agent will enroll in Fleet, download the configuration specified in the agent policy, and start collecting data.

Notes:

  • If you see an "x509: certificate signed by unknown authority" error, you might be trying to enroll in a Fleet Server that uses self-signed certs. To fix this problem in a non-production environment, pass the --insecure flag. For more information, refer to the troubleshooting guide.
  • Refer to Installation layout for the location of installed Elastic Agent files.
  • Because Elastic Agent is installed as an auto-starting service, it will restart automatically if the system is rebooted.

To confirm that Elastic Agent is installed and running, go to the Agents tab in Fleet.

Fleet showing enrolled agents

If the status hangs at Enrolling, make sure the elastic-agent process is running.

If you run into problems:

For information about managing Elastic Agent in Fleet, refer to Centrally manage Elastic Agents in Fleet.