Install Elastic Agent
editInstall Elastic Agent
editThis functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
Download and install Elastic Agent on each system you want to monitor.
To download and install Elastic Agent, use the commands that work with your system:
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-amd64.deb sudo dpkg -i elastic-agent-7.9.3-amd64.deb
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-x86_64.rpm sudo rpm -vi elastic-agent-7.9.3-x86_64.rpm
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-darwin-x86_64.tar.gz tar xzvf elastic-agent-7.9.3-darwin-x86_64.tar.gz
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-linux-x86_64.tar.gz tar xzvf elastic-agent-7.9.3-linux-x86_64.tar.gz
We recommend that you use the DEB or RPM distribution, instead of the tarball, to ensure that Elastic Agent restarts automatically if the system is rebooted.
- Download the Elastic Agent Windows zip file from the downloads page.
-
Extract the contents of the zip file into
C:\Program Files
. -
Rename the
elastic-agent-<version>-windows
directory toElastic-Agent
.
Manually install Elastic Agent as a service on macOS
editIf you want Elastic Agent to be persistent after restarts, you need to install and run it as a service. Improved support for running Elastic Agent as a service on macOS will be available in a future release.
-
Create a file called
co.elastic.agent.plist
in/Library/LaunchDaemons/
and copy the following settings into the new file:<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>co.elastic.agent</string> <key>ProgramArguments</key> <array> <string>/Library/Elastic/Agent/elastic-agent</string> <string>run</string> </array> <key>RunAtLoad</key> <true/> <key>WorkingDirectory</key> <string>/Library/Elastic/Agent</string> <key>UserName</key> <string>root</string> <key>KeepAlive</key> <true/> <key>ThrottleInterval</key> <integer>15</integer> <key>EnableTransactions</key> <false/> <key>ExitTimeOut</key> <integer>60</integer> </dict> </plist>
-
Change the ownership of the
.plist
file toroot
:sudo chown root:wheel /Library/LaunchDaemons/co.elastic.agent.plist
-
Create the path
/Library/Elastic/Agent/
. -
Copy the files that you extracted from
elastic-agent-7.9.3-darwin-x86_64.tar.gz
into/Library/Elastic/Agent/
. -
Start the agent as a service:
sudo launchctl load -w /Library/LaunchDaemons/co.elastic.agent.plist
This command starts the agent, so do not attempt to use the
run
command.
To stop and remove the service:
-
Stop the service and remove the property list file:
sudo launchctl unload -w /Library/Launchdaemons/co.elastic.agent.plist rm /Library/Launchdaemons/co.elastic.agent.plist
-
Unenroll the agent from Fleet.
Unenrolling the agent should stop Elastic Agent and any other programs started by the agent, such as Elastic Endpoint Security and data shippers.
-
If necessary, manually kill the
elastic-agent
process and any other processes started by the agent.