Elastic Stack, also known as ELK, comprises three open-source programs: Elasticsearch, Logstash and Kibana. The stack is optimized for searching, analyzing, and visualization of large volumes of log data. The main components of the Elastic Stack are:
This article describes how to install Elastic Stack on Ubuntu 20.04 server.
Update system packages.
$ sudo apt update
Install required packages.
$ sudo apt install wget curl gnupg2 -y
To run Elasticsearch, you require Java. Install Java.
$ sudo apt install openjdk-11-jdk -y
Verify the installation.
$ java -version
Kibana dashboard uses Nginx as a reverse proxy. Install Nginx webserver.
$ sudo apt install nginx -y
Install required packages.
$ sudo apt install apt-transport-https -y
Import the Elasticsearch PGP signing key.
$ wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
Add Elasticsearch APT repository.
$ echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee –a /etc/apt/sources.list.d/elastic-7.x.list
Update the system.
$ sudo apt update
Install Elasticsearch.
$ sudo apt install elasticsearch -y
Edit Elasticsearch configuration file.
$ sudo nano /etc/elasticsearch/elasticsearch.yml
Uncomment the following lines.
#network.host: 192.168.0.1
#http.port: 9200
Change value of network.host
to localhost
and add the following line in the Discovery section.
discovery.type: single-node
The final file should have the lines as follows:
network.host: localhost
http.port: 9200
discovery.type: single-node
Save and close the file.
Reload the daemon.
$ sudo systemctl daemon-reload
Start the Elasticsearch service.
$ sudo systemctl start elasticsearch
Enable Elasticsearch service to start at system startup.
$ sudo systemctl enable elasticsearch
Verify that Elasticsearch is running and listening on port 9200.
$ curl -X GET "localhost:9200"
Install Logstash.
$ sudo apt install logstash -y
Start the Logstash service.
$ sudo systemctl start logstash
Enable Logstash service to start at system startup.
$ sudo systemctl enable logstash
Verify Logstash service status.
$ sudo systemctl status logstash
Install Kibana.
$ sudo apt install kibana -y
Edit the Kibana configuration file.
$ sudo nano /etc/kibana/kibana.yml
Uncomment and modify the following lines from:
#server.port: 5601
#server.host: "localhost"
#elasticsearch.hosts: ["http://localhost:9200"]
To:
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://localhost:9200"]
Save and close the file.
Start the Kibana service.
$ sudo systemctl start kibana
Enable Kibana service to start at system startup.
$ sudo systemctl enable kibana
Allow traffic on port 5601
.
$ sudo ufw allow 5601/tcp
Install Filebeat.
$ sudo apt install filebeat -y
Edit the Filebeat configuration file.
$ sudo nano /etc/filebeat/filebeat.yml
Comment out the following lines:
#output.elasticsearch:
# Array of hosts to connect to.
#hosts: ["localhost:9200"]
Uncomment these lines in Logstash output section:
output.logstash:
hosts: ["localhost:5044"]
Save and exit the file.
Enable the Filebeat system module.
$ sudo filebeat modules enable system
Load the index template.
$ sudo filebeat setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'
Start the Filebeat service.
$ sudo systemctl start filebeat
Enable Filebeat service to start at system startup.
$ sudo systemctl enable filebeat
Verify that Filebeat is shipping log files to Logstash for processing.
$ curl -XGET http://localhost:9200/_cat/indices?v
Open your web browser and access the Kibana web interface using the URL http://YourServerIP:5601
. For example:
http://192.0.2.10:5601
You have successfully installed Elastic Stack on your server. You can now access the main dashboard via the Kibana web interface.
For more information, please see: