Overview
Canary supports outgoing Webhooks from your Console to an endpoint of your choice. This event-driven approach ensures that alerts are sent to you as they happen!
In this guide, we’ll send data to your Elastic Stack instance, using a Thinkst Canary Generic Webhook.
1. Create Agent Policy in Elastic Fleet
- Go to Assets > Fleet > Policies.
- Click Create Agent Policy.
- Name it something like FleetOps
- Ensure "Collect system logs and metrics" is enabled.
- Click Create agent policy.
2. Set Up the HTTP Integration
- Inside FleetOps, click Add integration.
- Search for HTTP.
- Choose Custom HTTP Endpoint Logs.
- Click Add Custom HTTP Endpoint Logs.
- Name your integration (e.g. http_endpoint-2).
- Under Change defaults:
- Listen address: 127.0.0.1
- Listen port: 8080 (or your preferred port)
- Dataset name: leave as default or customise
- Click Save and continue, then Save integration.
3. Enrol the Elastic Agent
You can install the Elastic Agent on any supported operating system, but the example below covers installation and enrollment on a Linux-based EC2 instance.
- In Kibana, go to Fleet > Agents. and click Add agent.
- Copy the curl and install commands shown for Linux x86_64.
- SSH into your EC2 instance and run:
# curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-9.0.0-linux-x86_64.tar.gz
# tar xzvf elastic-agent-9.0.0-linux-x86_64.tar.gz
# cd elastic-agent-9.0.0-linux-x86_64
# sudo ./elastic-agent install --url=<fleet-url> --enrollment-token=<your-token>
- After installation, your agent should appear as healthy in the Elastic UI under the FleetOps policy.
4. Configure TLS
To ensure secure communication, it’s important to expose the Elastic Agent endpoint over HTTPS. This is the safest and recommended approach, especially for production environments.
- Obtaining a TLS certificate using your preferred method (e.g., Let’s Encrypt, a commercial CA, or internal PKI).
- Setting up a web server or reverse proxy (such as Caddy, Nginx, or Apache) to handle TLS termination and route traffic securely to the Elastic Agent.
The Elastic Agent should be bound to a local interface (e.g., 127.0.0.1:8080). Your reverse proxy should securely expose the agent endpoint over port 443 (HTTPS). Use firewall rules to ensure that only port 443 is accessible externally, while the internal agent port remains private.
- Add EC2 Public IP as a Webhook in Thinkst Canary
- In the Thinkst Canary Console, go to Settings > Webhooks.
- Click Add new Generic Webhook.
- Paste the webhook URL:
https://<your-domain-or-ec2-ip>/