# Install SingleStore Flow This section contains instructions for installing Ingest and XL Ingest, and license information. To use Ingest and XL Ingest, install the products and provide the product IDs to either [ team@singlestore.com](mailto:team@singlestore.com) or your account representative to obtain either a paid license or a Developer trial license. ## Prerequisites While the database prerequisites will vary based on the source, the following are the minimum requirements for using both Ingest and XL Ingest. | **Component** | **Requirements** | | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Virtual Machine (VM) | The sizing recommendation is based on the size of databases/tables being transferred.For smaller databases sized 100GB or less, a minimum of 2 vCPUs, 8 GB RAM, and 100 GB of free disk space is recommended.For large transfers, more disk space may be required. The required free space for Ingest is twice the size of the largest table to be transferred.For very large tables, where XL Ingest must be used, the amount of local disk needed is`2 x (logical partition size) x (number of concurrent partition transfers)`.More CPU cores and RAM is required for sources and destinations that contain a large amount of data and have an aggressive timeline in which to transfer it.The VM must be close to the source database to minimize latency.Refer to the[Recommended Hardware Configuration](https://docs.singlestore.com/db/v9.0/load-data/load-data-with-singlestore-flow/singlestore-ingest/#section-idm234737713970451.md)section in the Ingest documentation for more information. | | Browser | A Chromium-based browser, such as[Google Chrome](https://www.google.com/chrome/)or[Microsoft Edge](https://www.microsoft.com/en-us/edge/), installed on the VM | | Java | [Amazon Corretto Java 21](https://docs.aws.amazon.com/corretto/latest/corretto-21-ug/downloads-list.html), a no-cost distribution of the Open Java Development Kit (OpenJDK), installed on the VM | ## Set Up the Encryption Key Flow encrypts sensitive values in `config/config.xml` with AES-256-CBC. The Flow JVM reads the encryption key from the `FLOW_ENCRYPTION_KEY` environment variable. New installations must configure an encryption key before storing encrypted secrets. Use the following key requirements: * Algorithm: AES-256. The decoded key must be exactly 32 bytes. * Encoding: Base64, with optional trailing = padding. Flow validates the key at startup. If `FLOW_ENCRYPTION_KEY` is set but invalid, Flow does not start. If `FLOW_ENCRYPTION_KEY` is not set, new installations will not start, but upgraded installations may fall back to a legacy hardcoded key (insecure and deprecated). When Flow resolves the key successfully, it writes `Info(CMG500)` to the log together with a short SHA-256 fingerprint. Use this entry to confirm which key the process is using without exposing the key. **Note**: SingleStore recommends rotating the encryption key every 90 to 180 days for security. Refer to [Rotate the Encryption Key](https://docs.singlestore.com/db/v9.0/load-data/load-data-with-singlestore-flow/rotate-the-encryption-key.md) for the key rotation procedure. ## Generate a Key on Windows Run the following PowerShell commands to generate a Base64-encoded 32-byte key. The commands use a cryptographically secure random generator. ```shell $bytes = New-Object byte[] 32 [Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes) [Convert]::ToBase64String($bytes) ``` If OpenSSL is available on the Windows host, run the following command: ```shell openssl rand -base64 32 ``` Store the generated value in a secret manager or another secure location. This value is required when configuring the `FLOW_ENCRYPTION_KEY`. ## Generate a Key on Linux or macOS Use OpenSSL to generate a Base64-encoded 32-byte key. OpenSSL is preinstalled on every supported Linux distribution. Run the following command: ```shell openssl rand -base64 32 ``` Store the generated value in a secret manager or another secure location. This value is required when configuring the `FLOW_ENCRYPTION_KEY`. ## Install Ingest You can install Ingest in both Windows and non-Windows environments. ## Install Ingest as a Windows Service **Note**: Filenames may change from release to release. 1. Download the following files to your host: * Ingest JAR: * Ingest Setup ZIP: 2. Unzip the Ingest setup ZIP file. This creates an `ingest` directory. 3. Move the `ingest` directory to your desired install location. For example, `C:\SingleStore\ingest`. 4. Copy the downloaded `ingest.jar` file into the **ingest directory** so that all required files are in the same location. 5. Change the directory to the `ingest` directory and open the `ingest.xml` file in a Notepad. Change the following lines as per your requirements. | `SingleStore-Ingest` | This tag is used as a unique ID in Windows services.EachIngestpipeline has its own ID. | | ----------------------------------------------- | -------------------------------------------------------------------------------------- | | `SingleStore Ingest` | This tag is a display name in the Windows services.It must be brief but descriptive. | | `SingleStore Ingest` | This tag specifies a description of theIngestservice. | **Note**: When a server hosts several Java versions, relying on the system’s default Java can result in version conflicts or unexpected failures. To guarantee Ingest uses the intended Java version, refer the full path to your required Java binary directly. For example, if Java 21 has been extracted to `C:\java\java21`, specify the absolute path to `java.exe` in your `ingest.xml` file: ```xml C:\java\java21\bin\java.exe ``` 6. In `ingest.xml`, uncomment the env line and replace the placeholder with the generated Base64 key. The service wrapper exports the key to the Java process automatically. ```xml ``` To keep the secret out of `ingest.xml`, omit the env element and set `FLOW_ENCRYPTION_KEY` as a Windows system environment variable in **System Properties** > **Advanced** > **Environment Variables**. The Ingest service reads the updated value the next time it starts. 7. Grant the following permissions to the user that runs the Ingest service, on the entire Ingest directory: * Read * Write * Delete Ensure that all contained files and subfolders get the same permissions. 8. Install Ingest as a Windows service. 1. Open a command prompt as an Administrator. 2. Change the current directory to the `ingest` directory and run the `Install-Service.bat` file using the following command. ```shell Install-Service.bat ``` This batch file runs commands to install the service. Once the command is completed, close the command prompt. 9. The Ingest service must appear in the Windows services list like `SingleStore-Ingest`, matching the ID set earlier. 10. The Ingest service starts automatically upon installation and must be running. You can start, stop, or restart the Ingest service similar to other Windows services. 11. To verify the encryption configuration, open the most recent log file under `ingest\log\` and search for `CMG500`. Verify that the log contains the following line: ```shell Info(CMG500): Resolved AES-256 encryption key from FLOW_ENCRYPTION_KEY env var (fingerprint <16-hex-chars>) ``` If the log shows "`...from legacy hardcoded fallback`", Flow is using an insecure default key instead of `FLOW_ENCRYPTION_KEY`. This means the environment variable was not successfully passed to the JVM. Recheck the `ingest.xml` env entry, or the Windows system environment variable, and then restart the service. 12. Open a Chromium-based browser at `http://localhost:8081`, or `http://:8081` if the application is installed on a remote server. You can change this port from the user interface (UI). The new port setting takes effect after the next run. 13. Navigate to **Settings** > **License** and enter the license key. ## Install Ingest in Non-Windows Environment 1. Download the following files to your host: * Ingest JAR: * Ingest Setup ZIP: 2. Unzip the Ingest setup ZIP file. This creates an `ingest` directory. 3. Move the `ingest` directory to your desired install location. For example, `/opt/singlestore/ingest`. 4. Copy the downloaded `ingest.jar` file into the **ingest directory** so that all required files are in the same location. 5. Configure and start Ingest using ONE of the following methods: * Edit the launcher `ingest.sh` in the Ingest directory. Uncomment the `FLOW_ENCRYPTION_KEY` lines and replace the placeholder with the generated Base64 key. ```shell export FLOW_ENCRYPTION_KEY=YOUR_BASE64_KEY_HERE java -cp ingest.jar:lib/*:. org.sirus.Run ``` To start Ingest, run: ```shell ./ingest.sh ``` * Leave `ingest.sh` unchanged, and export `FLOW_ENCRYPTION_KEY` in the shell that launches Ingest, then start Ingest. ```shell export FLOW_ENCRYPTION_KEY=YOUR_BASE64_KEY_HERE java -jar ingest.jar ``` * Pass the key as a Java system property. ```shell java -Dflow.encryption.key=YOUR_BASE64_KEY_HERE -jar ingest.jar ``` **Note**: The `flow.encryption.key` Java system property takes precedence over the environment variable. This precedence is useful when multiple Flow instances run on the same host with different keys. 6. Tail the most recent file under `log/` and search for `CMG500`: ```shell grep -F 'Info(CMG500)' log/*.log | tail ``` Expected output: ```shell Info(CMG500): Resolved AES-256 encryption key from FLOW_ENCRYPTION_KEY env var (fingerprint <16-hex-chars>) ``` If the log shows "`..from legacy hardcoded fallback`", the variable was not exported into the JVM environment. Confirm it in the same shell that launched Ingest. ```shell env | grep FLOW_ENCRYPTION_KEY ``` 7. Open a Chromium-based browser at `http://localhost:8081`, or `http://:8081` if the application is installed on a remote server. You can change this port from the user interface (UI). The new port setting takes effect after the next run. 8. Navigate to **Settings** > **License** and enter the license key. ## Install XL Ingest You can install XL Ingest in both Windows and non-Windows environments. **Note**: Filenames may change from release to release. ## Install XL Ingest as a Windows Service 1. Download the following files to your host: * XL Ingest JAR: [https://release.memsql.com/singlestoreflow/production/2.6.4-41dd1b10/xl-ingest.jar](https://release.memsql.com/singlestoreflow/production/2.6.0-b9df345a/xl-ingest.jar) * XL Ingest Setup ZIP: 2. Unzip the XL Ingest setup ZIP file. This creates an `xlingest` directory. 3. Move the `xlingest` directory to your desired install location. For example, `C:\SingleStore\xlingest`. 4. Copy the downloaded `xl-ingest.jar` file into the **xlingest directory** so that all required files are in the same location. 5. Change the directory to the `xlingest` directory and open `xlingest.xml` file in a Notepad. Change the following lines as per your requirements. | `SingleStore-XL-Ingest` | This tag is used as a unique ID in Windows services.EachXL Ingestpipeline has its own ID. | | -------------------------------------------------- | ----------------------------------------------------------------------------------------- | | `SingleStore XL Ingest` | This tag is a display name in the Windows services.It must be brief and descriptive. | | `SingleStore XL Ingest` | This tag specifies a description of theXL Ingestservice. | 6. In `xlingest.xml`, uncomment the env line and replace the placeholder with the generated Base64 key. The service wrapper exports the key to the Java process automatically. ```xml ``` XL Ingest and Ingest use the same `FLOW_ENCRYPTION_KEY` value because they share the same key. The XL Ingest service reads the updated value the next time it starts. 7. Install XL Ingest as a Windows service. 1. Open a command prompt as an Administrator. 2. Navigate to `xlingest` directory and run the `Install-SingleStore-XL-Ingest-Service.bat` file using the following command. ```shell Install-SingleStore-XL-Ingest-Service.bat ``` This batch file runs commands to install the service. Once the command is completed, close the command prompt. 8. The XL Ingest service must appear in the Windows services list like `SingleStore-XL-Ingest`, matching the ID you set earlier. 9. The XL Ingest service starts automatically upon installation and must be running. You can start, stop, or restart the XL Ingest service like other Windows services. 10. To verify the encryption configuration, open the most recent log file under `xlingest\log\` and search for `CMG500`. Verify that the log contains the following line: ``` Info(CMG500): Resolved AES-256 encryption key from FLOW_ENCRYPTION_KEY env var (fingerprint <16-hex-chars>) ``` If the log shows "`...from legacy hardcoded fallback`", Flow is using an insecure default key instead of `FLOW_ENCRYPTION_KEY`. This means the environment variable was not successfully passed to the JVM. Recheck the `xlingest.xml` env entry, or the Windows system environment variable, and then restart the service. 11. Open a Chromium-based browser at . If the application is installed on a server, navigate to `http://:8084` instead. 12. Navigate to **Configuration** > **License**, and enter the license key. ## Install XL Ingest in Non-Windows Environment 1. Download the following files to your host: * XL Ingest JAR: [https://release.memsql.com/singlestoreflow/production/2.6.4-41dd1b10/xl-ingest.jar](https://release.memsql.com/singlestoreflow/production/2.6.0-b9df345a/xl-ingest.jar) * XL Ingest Setup ZIP: 2. Unzip the XL Ingest setup ZIP file. This creates an `xl-ingest` directory. 3. Move the `xlingest` directory to your desired install location. For example, `/opt/singlestore/xlingest`. 4. Copy the downloaded `xl-ingest.jar` file into the **xlingest directory** so that all required files are in the same location. 5. Configure and start XL Ingest using ONE of the following methods: * Edit the launcher `xlingest.sh` in the ingest directory. Uncomment the `FLOW_ENCRYPTION_KEY` lines and replace the placeholder with the generated Base64 key. ```shell export FLOW_ENCRYPTION_KEY=YOUR_BASE64_KEY_HERE java -cp xl-ingest.jar:lib/*:. cirus.Run ``` To start XL Ingest, run: ```shell ./xlingest.sh ``` * Leave `xlingest.sh` unchanged, and export `FLOW_ENCRYPTION_KEY` in the shell that launches XL Ingest, then start XL Ingest. ```shell export FLOW_ENCRYPTION_KEY=YOUR_BASE64_KEY_HERE java -jar xl-ingest.jar ``` * Pass the key as a Java system property. ```shell java -Dflow.encryption.key=YOUR_BASE64_KEY_HERE -jar xl-ingest.jar ``` **Note**: The `flow.encryption.key` Java system property takes precedence over the environment variable. This precedence is useful when multiple Flow instances run on the same host with different keys. 6. Tail the most recent file under `log/` and search for `CMG500`: ```shell grep -F 'Info(CMG500)' log/*.log | tail ``` Expected output: ```shell Info(CMG500): Resolved AES-256 encryption key from FLOW_ENCRYPTION_KEY env var (fingerprint <16-hex-chars>) ``` If the log shows "`..from legacy hardcoded fallback`", the variable was not exported into the JVM environment. Confirm it in the same shell that launched XL Ingest. ```shell env | grep FLOW_ENCRYPTION_KEY ``` 7. Open a Chromium-based browser at . If the application is installed on a server, navigate to `http://:8084` instead. 8. Navigate to **Configuration** > **License**, and enter the license key. ## Apply the License Key The Flow suite of products comes with a validity period specific to each customer's agreement. You must obtain valid license keys to begin using the software. For learning and evaluation purposes, a free license with usage limits is available, refer to [Free Trial Access to Flow](https://docs.singlestore.com/db/v9.0/load-data/load-data-with-singlestore-flow/free-trial-access-to-flow.md) for more details. Licenses specify a maximum capacity in units. To transfer data to a SingleStore destination, the capacity of the Ingest license must be at least equal to the number of capacity units in the destination. Each software product has its own unique product ID when set up individually. To obtain a valid license, contact [SingleStore Sales](https://www.singlestore.com/contact/) with the **Product ID**. **For** Ingest, go to **Settings >** **Licence**. In **Licence Key**, enter the license key, and then select **Apply** to save the settings. To retrieve the Product ID, go to your Ingest instance, go to **Settings** > **Licence**, and copy the ID from the **'Product Id'**. ****For** XL Ingest,** go to **Configuration**. In **Licence Key**, enter the license key, and then select **Save** to save the settings. To retrieve the Product ID, go to your XL Ingest instance, go to **Configuration** > **Licence**, and copy the ID from the **'Product Id'**. *** Modified at: September 18, 2026 Source: [/db/v9.0/load-data/load-data-with-singlestore-flow/install-singlestore-flow/](https://docs.singlestore.com/db/v9.0/load-data/load-data-with-singlestore-flow/install-singlestore-flow/) (An index of the documentation is available at /llms.txt)