Deploy Fleet Server on-premises and Elasticsearch on Cloudedit

To use Fleet for central management, a Fleet Server must be running and accessible to your hosts. Deploying Fleet Server on-premises to work with a hosted Elasticsearch Service is one of several approaches to setting up Fleet Server.

Fleet Server on-premise and Elasticsearch on Cloud deployment model

To deploy a self-managed Fleet Server on-premises to work with a hosted Elasticsearch Service, you need to:


Fleet Server is compatible with the following Elastic products:

  • Elastic Stack 7.13 or later

    • For version compatibility: Elasticsearch >= Fleet Server >= Elastic Agent (except for bugfix releases)
    • Kibana should be on the same minor version as Elasticsearch
  • Elastic Cloud Enterprise 2.9 or later—​allows you to use a hosted Fleet Server on Elastic Cloud.

    • Requires additional wildcard domains and certificates (which normally only cover *.cname, not *.*.cname). This enables us to provide the URL for Fleet Server of https://.fleet..
    • The deployment template must contain an Integrations Server node.

    For more information about hosting Fleet Server on Elastic Cloud Enterprise, refer to Manage your Integrations Server.


Before deploying, you need to:

  • Obtain or generate a Cerfiticate Authority (CA) certificate.
  • Ensure components have access to the default ports needed for communication.
CA certificateedit

Before setting up Fleet Server using this approach, you will need a CA certificate to configure Transport Layer Security (TLS) to encrypt traffic between the Fleet Servers and the Elastic Stack.

If your organization already uses the Elastic Stack, you may already have a CA certificate. If you do not have a CA certificate, you can read more about generating one in Configure SSL/TLS for self-managed Fleet Servers.

This is not required when testing and iterating using the Quick start option, but should always be used for production deployments.

Default port assignmentsedit

When Elasticsearch or Fleet Server are deployed, components communicate over well-defined, pre-allocated ports. You may need to allow access to these ports. See the following table for default port assignments:

Component communication Default port

Elastic Agent → Fleet Server


Elastic Agent → Elasticsearch


Elastic Agent → Logstash


Elastic Agent → Fleet


Fleet Server → Fleet


Fleet Server → Elasticsearch


If you do not specify the port for Elasticsearch as 443, the Elastic Agent defaults to 9200.

Add Fleet Server hostsedit

Start by adding one or more Fleet Server hosts. A Fleet Server host is a URL your Elastic Agents will use to connect to a Fleet Server.

Fleet Server hosts should meet the following requirements:

  • All agents can connect to the host.
  • The host also has a route to the Elasticsearch you plan to use.
  • The host meets the minimum compute resource requirements based on the maximum number of agents you plan to support in your deployment.

To add a Fleet Server host:

  1. In Kibana, go to ManagementFleetSettings. For more information about these settings, see Fleet settings.
  2. Under Fleet Server hosts, click Edit hosts and specify one or more host URLs your Elastic Agents will use to connect to Fleet Server. For example,, where is the host IP where you will install Fleet Server. Save and apply your settings.

    If the Edit hosts option is grayed out, Fleet Server hosts are configured outside of Fleet. For more information, refer to Fleet settings in Kibana.

  3. Save and apply the settings.

Create a Fleet Server policyedit

Next, you’ll create a Fleet Server policy. The Fleet Server policy manages and configures the Elastic Agent running on the Fleet Server host to launch a Fleet Server process.

To create a Fleet Server policy:

  1. In Kibana, navigate to the Fleet page and go to the Agent policies tab.
  2. Click on the Create agent policy button, then:

    1. Provide a meaningful name for the policy that will help you identify this Fleet Server (or cluster) in the future.
    2. Ensure you select Collect system logs and metrics so the compute system hosting this Fleet Server can be monitored. (This is not required, but is highly recommended.)
  3. After creating the Fleet Server policy, navigate to the policy itself and click Add integration.
  4. Search for and select the Fleet Server integration.
  5. Then click Add Fleet Server.
  6. Configure the Fleet Server:

    1. Expand Change default. Because you are deploying this Fleet Server on-premises, you need to enter the Host address and Port number, 8220. (In our example the Fleet Server will be installed on the host
    2. It’s recommended that you also enter the Max agents you intend to support with this Fleet Server. This can also be modified at a later stage. This will allow the Fleet Server to handle the load and frequency of updates being sent to the agent and ensure a smooth operation in a bursty environment.

Add Fleet Serversedit

Now that the policy exists, you can add Fleet Servers. A Fleet Server is an Elastic Agent that is enrolled in a Fleet Server policy. The policy configures the agent to operate in a special mode to serve as a Fleet Server in your deployment.

To add a Fleet Server:

  1. Click the Agents tab.
  2. Click Add Fleet Server.
  3. This will open in-product instructions for adding a Fleet Server using one of two options. Choose Advanced.

    In-product instructions for adding a Fleet Server in advanced mode
  4. Follow the in-product instructions to add a Fleet Server.

    1. Choose the policy name for this deployment.
    2. Choose Production as your deployment mode.

      Production mode is the fully secured mode where TLS certificates ensure a secure communication between Fleet Server and Elasticsearch.

    3. Select the Fleet Server host that was identified earlier. Click Add host.
    4. A Service Token is required so the Fleet Server can write data to the connected Elasticsearch instance. Click Generate service token and copy the generated token.
    5. Copy the installation instructions provided in Kibana, which include some of the known deployment parameters.
    6. Replace the value of the --certificate-authorities parameter with your CA certificate.

After Fleet Server is installed and enrolled in Fleet, the newly created Fleet Server policy is applied. You can see this on the Fleet Server policy page.

The Fleet Server agent will also show up on the main Fleet page as another agent whose life-cycle can be managed (like other agents in the deployment).

Next stepsedit

Now you’re ready to add Elastic Agents to your host systems. To learn how, see Install Fleet-managed Elastic Agents.

For on-premises deployments, you can dedicate a policy to all the agents in the network boundary and configure that policy to include a specific Fleet Server (or a cluster of Fleet Servers).

Read more in Add a Fleet Server to a policy.