This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
Download and install Elastic Agent on each system you want to monitor.
To download and install Elastic Agent, use the commands that work with your system:
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.1-amd64.deb sudo dpkg -i elastic-agent-7.9.1-amd64.deb
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.1-x86_64.rpm sudo rpm -vi elastic-agent-7.9.1-x86_64.rpm
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.1-darwin-x86_64.tar.gz tar xzvf elastic-agent-7.9.1-darwin-x86_64.tar.gz
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.1-linux-x86_64.tar.gz tar xzvf elastic-agent-7.9.1-linux-x86_64.tar.gz
We recommend that you use the DEB or RPM distribution, instead of the tarball, to ensure that Elastic Agent restarts automatically if the system is rebooted.
- Download the Elastic Agent Windows zip file from the downloads page.
Extract the contents of the zip file into
If you want Elastic Agent to be persistent after restarts, you need to install and run it as a service. Improved support for running Elastic Agent as a service on macOS will be available in a future release.
Create a file called
/Library/LaunchDaemons/and copy the following settings into the new file:
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>co.elastic.agent</string> <key>ProgramArguments</key> <array> <string>/Library/Elastic/Agent/elastic-agent</string> <string>run</string> </array> <key>RunAtLoad</key> <true/> <key>WorkingDirectory</key> <string>/Library/Elastic/Agent</string> <key>UserName</key> <string>root</string> <key>KeepAlive</key> <true/> <key>ThrottleInterval</key> <integer>15</integer> <key>EnableTransactions</key> <false/> <key>ExitTimeOut</key> <integer>60</integer> </dict> </plist>
Change the ownership of the
sudo chown root:wheel /Library/LaunchDaemons/co.elastic.agent.plist
Create the path
Copy the files that you extracted from
Start the agent as a service:
sudo launchctl load -w /Library/LaunchDaemons/co.elastic.agent.plist
This command starts the agent, so do not attempt to use the
To stop and remove the service:
Stop the service and remove the property list file:
sudo launchctl unload -w /Library/Launchdaemons/co.elastic.agent.plist rm /Library/Launchdaemons/co.elastic.agent.plist
Unenrolling the agent should stop Elastic Agent and any other programs started by the agent, such as Elastic Endpoint Security and data shippers.
If necessary, manually kill the
elastic-agentprocess and any other processes started by the agent.