Part 2 | Configure Elastic Observability with Fleet

Configure Fleet in Elastic

Fleet is Centralized Management agent that dedicated on elastic stack. 

Fleet provides a web-based UI in Kibana for centrally managing Elastic Agents and their policies.

You can see the state of all your Elastic Agents in Fleet. On the Agents page, you can see which agents are healthy or unhealthy, and the last time they checked in. You can also see the version of the Elastic Agent binary and policy.

Fleet serves as the communication channel back to the Elastic Agents. Agents check in for the latest updates on a regular basis. You can have any number of agents enrolled into each agent policy, which allows you to scale up to thousands of hosts.

It helps us to manage : 

• Elastic Agent
• Elastic Integration
• Policy
• and centralized management

Step 1 – Install Fleet server via Kibana

Open your Kibana that already installed on 

Open Management > Fleet > Add Fleet Server

insert your Fleet server IP with Port (default 8220) and generate Fleet server policy

Run this Command on your Local Elasticstack Server

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.4.1-linux-x86_64.tar.gz
tar xzvf elastic-agent-8.4.1-linux-x86_64.tar.gz
cd elastic-agent-8.4.1-linux-x86_64
sudo ./elastic-agent install \
  --fleet-server-es=http://10.10.10.178:9200 \
  --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NjMyMTQ1ODQyNTE6M1NIVlk2bGhTVUtnTkRSMC1VNS1aZw \
  --fleet-server-policy=fleet-server-policy

And Continue enrolling Elastic Agent. 

Next Check your Elastic Agent. and Make sure it have integration with Fleet_server 

and in Healthy status Condition

then Makesure your Settings already listen on FLEETSERVERIP:8220

Open Fleet > Settings > Outputs 

Step 2 – Elastic Agent

in this Case we want to use all Function of Elastic Observability that have feature of. and to use that, we need to install Elastic Agent on monitored Endpoint

• APM (in this case we want to monitor PHP Application)
• Uptime
• Logs stream
• Alerting
• Real User Monitoring (only works on NodeJS Application)

Prerequisites on Endpoint (10.10.10.179)

• Installed Elastic Agent
• Installed APM-Agent
• Installed PHP Application – in this case we monitor Nextcloud on this Tutorial 

Step 3 – Install Elastic Agent 

Open Your Flteet > Agents > Add Agent 

After that Enroll Agent with Settings like Bellow 

and Then run this command to Enroll Elastic-agent on Monitored Endpoint – 10.10.10.179

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.4.1-linux-x86_64.tar.gz
tar xzvf elastic-agent-8.4.1-linux-x86_64.tar.gz
cd elastic-agent-8.4.1-linux-x86_64
sudo ./elastic-agent install --url=https://10.10.10.178:8220 --enrollment-token=SzdJbElZTUI1RmYxUHdDblZheko6VFlhN2tGZG5UYWVBV2xWeDl0Yjh0UQ==

and then wait few minutes, and wait until Agent already Listenend. 

then Confirm incoming data. and after that, hosts agent on fleet already created. 

next Confirm your elastic-agent already in healthy status

Step 4 – Working with APM

Open Integration > Choose Elastic APM and add APM-Agent 

After Add Elastic APM will pop up a window bellow, and Create Integration rules 

After all it done, Open integration again and choose APM. 

then Follow this guide bellow 

After you Create APM Integration in Fleet u should already have a Connection

then Check APM Server status 

install PHP Agent on Monitored Endpoint

open your ssh on endpoint then install php agent 

download the package on Github Release 

wget https://github.com/elastic/apm-agent-php/releases/download/v1.6.1/apm-agent-php_1.6.1_all.deb
dpkg -i apm-agent-php_1.6.1_all.deb

after php agent installed. open your running php.ini config 

nano /etc/php/7.4/cli/php.ini

add this configuration

elastic_apm.server_url="http://10.10.10.178:8200" ;point to your elastic collector
elastic_apm.secret_token="" ;leave it empty if not configured
elastic_apm.service_name="APM-nextcloud"

then restart the webserver services

systemctl restart apache2

Make sure your Agent Status already Successful then Launch APM 

Checking your APM Service on Kibana

Open your Kibana access to http://10.10.10.178:5601 and open Observability > APM 

then you will see the APM dashboard, logs, transactios, Map, Infrastructure, and other Metrics

Step 4 – Add Uptime monitor

Open your Kibana > Integration > choose Uptime Monitors

http://10.10.10.178:5601/app/home#/tutorial/uptimeMonitors

To configure uptime monitor, we need to Install the Integration on Elastic Server (10.10.10.178) not on the Agent Endpoint!

curl -L -O https://artifacts.elastic.co/downloads/beats/heartbeat/heartbeat-8.4.1-amd64.deb
sudo dpkg -i heartbeat-8.4.1-amd64.deb

modify the  configuration at /etc/heartbeat/heartbeat.yml

output.elasticsearch:
  hosts: ["<10.10.10.178:9200>"] #ip elastic server collector
  username: "elastic" #your elastic username 
  password: "<Makanlaron11>" ##your elastic password
  # If using Elasticsearch's default certificate
  ssl.ca_trusted_fingerprint: "<es cert fingerprint>"
setup.kibana:
  host: "<10.10.10.178:5601>" ##your kibaana url

Adding the Monitored Endpoint. bellow is the sample configuration 

in this case i want to monitor HTTP service on 10.10.10.179

heartbeat.monitors:
- type: http

  id: nextcloud-update
  name: Nextcloud Uptime

  urls: ["http://10.10.10.179"]

  schedule: '@every 10s'
  service.name: unknown-php-service

add config like bellow, if you want to add another monitored endpoint

you can also specify Port Type : Tcp, Udp, http, icmp, etc. and IP Address 

- type: tcp
  schedule: '@every 5s'
  hosts: ["10.10.10.178:5601"]
  mode: any
  id: elastic-stack-uptime
  name: Elastic server uptime

after we add the configuration. then we Setup and restart the service

sudo heartbeat setup
sudo service heartbeat-elastic start

Check the Data and Launch Uptime App

Step 5 – Enable RUM (Real user monitoring )

Coming soon

For now we cant enable this function. 

it need dependencies to monitor NodeJS Application