Beat agents installation on multiple servers / hosts

Elastic Stack Beats
1

I have installed beat agents on single machine and I want to get them installed (winlogbeat, metricbeat and filebeat) on 5 more machines in my environment. I don't want to login to each and every machine and install them. I want to run a powershell script or single step installation method to acheive this.
Has anyone ran into these issues? or accomplished it? Please help me out! thanks

2

If you have Active Directory, you can use Group Policy to install MSI package with beats, but the difficult is to prepare such MSI package. For creating MSI package i`ve used SharpDevelop IDE with WiX for building installers.

If you want to use batch scripts, u can use it like this:

  1. variant - Run script on targer machine
Code and comments

mkdir "C:\ProgramData\beats\Winlogbeat" - create folder, where u want to copy beat

copy "\path_to_shared_folder_with_all_nessesary_files\Winlogbeat*.*" "C:\ProgramData\beats\Winlogbeat" /y - copy files from network shared folder to target folder

sc create Winlogbeat binPath= ""C:\ProgramData\beats\winlogbeat\winlogbeat.exe" -c "C:\ProgramData\beats\winlogbeat\winlogbeat.yml" -path.home "C:\ProgramData\beats\winlogbeat" -path.data "C:\ProgramData\winlogbeat"" DisplayName= "Winlogbeat" type= own start= auto - this create winservice and set path to config and other params

sc start winlogbeat - start service

For other beats it will be the same.

  1. Variant - create service on a target machine from remote PC.
    If your account sets as a local administrator on all machines, you need 2 things:
  1. copy in some way files to target pc (use admin resources \pc_name\c$\C:\ProgramData\beats\winlogbeat or other way)
  2. run cmd and use SC to create service:
    sc \pc_name create Winlogbeat binPath= ""C:\ProgramData\beats\winlogbeat\winlogbeat.exe" -c "C:\ProgramData\beats\winlogbeat\winlogbeat.yml" -path.home "C:\ProgramData\beats\winlogbeat" -path.data "C:\ProgramData\winlogbeat"" DisplayName= "Winlogbeat" type= own start= auto
    and start service
    sc \pc_name start winlogbeat

before we stopped using smb1, we had script with menues for install, uninstall service, update config, check if installed and other.

if you need some details - ask me, i`ll try to help u

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.