IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Elastic Agent policies Encrypt traffic in a self-managed cluster »
Elastic Docs ›Fleet and Elastic Agent Guide [7.13]

Fleet enrollment tokens

edit

Fleet enrollment tokens

edit

A Fleet enrollment token is an Elasticsearch API key that you use to enroll one or more Elastic Agents in Fleet. The enrollment token enrolls the Elastic Agent in a specific agent policy that defines the data to be collected by the agent. You can use the token as many times as required. It will remain valid until you revoke it.

The enrollment token is used for the initial communication between Elastic Agent and Fleet Server. After the initial connection request from the Elastic Agent, the Fleet Server passes two API keys to the Elastic Agent:

  • An output API key

    This API key is used to send data to Elasticsearch. It has the minimal permissions needed to ingest all the data specified by the agent policy. If the API key is invalid, the Elastic Agent stops ingesting data into Elasticsearch.

  • A communication API key

    This API key is used to communicate with the Fleet Server. It has only the permissions needed to communicate with the Fleet Server. If the API key is invalid, Fleet Server stops communicating with the Elastic Agent.

Create enrollment tokens

edit

Create enrollment tokens and use them to enroll Elastic Agents in specific policies.

When you use the Fleet UI to add an agent or create a new policy, Fleet creates an enrollment token for you automatically.

To create an enrollment token:

  1. Log in to Kibana and go to Management > Fleet.

    Fleet in Kibana

  2. In Fleet, click Agents > Enrollment tokens > Create enrollment token. Name your token and select an agent policy.

    Enrollment tokens tab in Fleet
  3. Click Create enrollment token.

  4. In the list of tokens, click the Show token icon to see the token secret.

    Enrollment tokens tab with Show token icon highlighted

All Elastic Agents enrolled through this token will use the selected policy unless you assign or enroll them in a different policy.

To learn how to install Elastic Agents and enroll them in Fleet, refer to Install Elastic Agents.

Revoke enrollment tokens

edit

To revoke an enrollment token:

  1. In Fleet, click Agents > Enrollment tokens.

  2. Find the token you want to revoke in the list and click the Revoke token icon.

    Enrollment tokens tab with Revoke token highlighted
  3. Click Revoke enrollment token. You can no longer use this token to enroll Elastic Agents. However, the currently enrolled agents will continue to function.

To re-enroll your Elastic Agents, use an active enrollment token.

« Elastic Agent policies Encrypt traffic in a self-managed cluster »