Install Elastic Agent from an MSI package

MSI is the file format and command line utility for the Windows Installer. Windows Installer (previously known as Microsoft Installer) is an interface for Microsoft Windows that’s used to install and manage software on Windows systems. This section covers installing Elastic Agent through the MSI package repository.

The MSI package installer must be run by an administrator account. The installer won’t start without Windows admin permissions.

1. Download the latest Elastic Agent MSI binary from the Elastic Agent download page.

2. Run the installer. The command varies slightly depending on whether you’re using the default Windows command prompt or PowerShell.

   Admonition

   • Using the default command prompt:

     elastic-agent-<VERSION>-windows-x86_64.msi INSTALLARGS="--url=<URL> --enrollment-token=<TOKEN>"
     		

   • Using PowerShell:

     ./elastic-agent-<VERSION>-windows-x86_64.msi --% INSTALLARGS="--url=<URL> --enrollment-token=<TOKEN>"
     		

   Where:

   • VERSION is the Elastic Stack version you’re installing, indicated in the MSI package name. For example, 8.13.2.
   • URL is the Fleet Server URL used to enroll the Elastic Agent into Fleet. You can find this on the Fleet Settings tab in Kibana.
   • TOKEN is the authentication token used to enroll the Elastic Agent into Fleet. You can find this on the Fleet Enrollment tokens tab.

   When you run the command, the value set for INSTALLARGS will be passed to the elastic-agent install command verbatim.

3. If you need to troubleshoot, you can install using msiexec with the -L*V "log.txt" option to create installation logs:

   msiexec -i elastic-agent-<VERSION>-windows-x86_64.msi INSTALLARGS="--url=<URL> --enrollment-token=<TOKEN>"  -L*V "log.txt"
   		

Installing using an MSI package has the following behaviors:

• If INSTALLARGS are not provided, the MSI will copy the files to a temporary folder and finish.
• If INSTALLARGS are provided, the MSI will copy the files to a temporary folder and then run the elastic-agent install command with the provided parameters. If the install flow is successful, the temporary folder is deleted.
• If INSTALLARGS are provided but the elastic-agent install command fails, the top-level folder is NOT deleted, in order to allow for further troubleshooting.
• If the elastic-agent install command fails for any reason, the MSI will rollback all changes.
• If the Elastic Agent enrollment fails, the install will fail as well. To avoid this behavior you can add the --delay-enroll option to the install command.

You can upgrade Elastic Agent through Fleet. If you want to upgrade outside Fleet using the MSI, you must uninstall and reinstall the agent. The MSI implementation relies on the TAR Elastic Agent binary to upgrade the installation. If you installed Elastic Agent in an air-gapped environment, ensure the TAR image is available before you request an upgrade.

For versions earlier than 9.4.0, the registered MSI version in the Windows Registry displays the initially installed version, while Fleet and ingested data metadata show the correct version. Upgrade to 9.4.0 or later to automatically update the registry entry.

Starting in version 8.13, it’s also possible to override the default installation folder by running the MSI from the command line, as shown:

elastic-agent-<VERSION>-windows-x86_64.msi INSTALLARGS="--url=<URL> --enrollment-token=<TOKEN>" INSTALLDIR="<path of custom folder>"