Need help with Elastic agent installation

Elastic Stack Elastic Agent
1

It has been a few days that I am going through all documentations to install Elastic-agent either with Fleet Server or Stand-alone, but still, I have not been able to understand how each components works, what is the precise step-by-step method etc. So below, I describe my environment and errors I have got, please tell me what I am doing wrong.

On a Ubuntu 22.04.2 LTS, Elastic Search and Kibana 8.8.1 on Docker - both listening on port 9200, 5601 respectively. I enroll Kibana and successfully login.

Kibana > Management > Fleet > Add Fleet Server

sudo ./elastic-agent install \
  --fleet-server-es=https://172.19.0.2:9200 \
  --fleet-server-service-token=some_hash\
  --fleet-server-policy=fleet-server-policy \
  --fleet-server-es-ca-trusted-fingerprint=some_hash \
  --fleet-server-port=8220

Agent get installed at /opt/Elastic/Agent and will run as a service and then: Successfully enrolled the Elastic Agent. Elastic Agent has been successfully installed.

After, on Kibana, Fleet Server Connected, Continue enrolling Elastic agent. Clicking Contine -> Enroll in Fleet -> Agent policy 1 -> Create. Then I should run:

sudo ./elastic-agent install --url=https://172.18.0.2:9200 --enrollment-token=some_hash
Error: already installed at: /opt/Elastic/Agent

And if I use enroll:

Error: fail to enroll: fail to execute request to fleet-server: dial tcp 172.18.0.2:9200: connect: connection refused

And if enroll as --insecure

"message":"SSL/TLS verifications disabled.","ecs.version":"1.6.0"}
Error: fail to enroll: fail to execute request to fleet-server: dial tcp 172.18.0.2:9200: connect: connection refused

What I am doing wrong?

Meanwhile, once Adding Fleet Server, the Agent get installed. Then why should I enroll an agent again in the next step with install command?
Also, if I want to use Agent as Stand-alone, I get to same dead-end.

Can you please direct me to step-by-step instruction to implement Stand-alone agent using Docker Image 8.8.1 or using TAR/RPM package?

2

If you have enrolled the Elastic Agent on that host with a Fleet Server you do not need to enroll that host again with another Elastic Agent. The Elastic Agent is already runing.

The UI is highlighting that once your have a Fleet Server/Elastic Agent that you will want to add another host to enroll into that Fleet Server.

Being that you are enrolling a Fleet Server you would be better off to not use standalone mode, and instead enroll Elastic Agents into the Fleet Server. This shows how to enroll an Elastic Agent into that Fleet Server your enrolled. Run Elastic Agent in a container | Fleet and Elastic Agent Guide [8.8] | Elastic

1 Like
3

Thanks. So it is okay to use Fleet Server policy for Integrations - especially in Production env?
I have actually done it and worked (in my case Postgres). just want to know if this is the right practice or I should create new policy and add Agent to it?
And if this is the case, then again, I will get the enrollment errors stated above. What should I do? Do I need to use another host?

4

It is completely acceptable to use that Elastic Agent for integrations. You should only have 1 Elastic Agent per host.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.