Logicalwebhost Cheatsheet

Linux & Open Source Cheatsheets & Howto's

Skip to: Content | Sidebar | Footer

Elasticsearch Logstash Kibana ELK server howto

If you want to search large volumes of network traffic, syslog, and other kinds of data and sort through and visualize them, ELK stack is a pretty good way to start. You can also add Graphana if you want to visualize stuff.

This howto is using Debian Stretch (9.x), though you can adapt this to whatever you have.

ELK setup on Debian Stretch (9)

You have to install Java first, then add repositories from Elasticsearch.co website. You need lots of memory and disk space to build this, I used 4GB RAM on a 64 bit system, but 1GB wouldn’t work, Java wouldn’t start.

wget --no-check-certificate --no-cookies --header "Cookie: oraclelicense=accept-securebackup-cookie" http://download.oracle.com/otn-pub/java/jdk/8u171-b11/512cd62ec5174c3487ac17c61aaa89e8/jdk-8u171-linux-x64.tar.gz
java -version
  java version "1.8.0_171"
  Java(TM) SE Runtime Environment (build 1.8.0_171-b11)
  Java HotSpot(TM) 64-Bit Server VM (build 25.171-b11, mixed mode)
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add -
echo "deb https://artifacts.elastic.co/packages/6.x/apt stable main" | tee -a /etc/apt/sources.list.d/elk.list
apt-get update
apt-get install elasticsearch
systemctl enable elasticsearch
systemctrl start elasticsearch
curl -X GET http://localhost:9200
  "name" : "VYxIwOT",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "RGs9BYi-RZudJtV0htkRyA",
  "version" : {
    "number" : "5.6.9",
    "build_hash" : "877a590",
    "build_date" : "2018-04-12T16:25:14.838Z",
    "build_snapshot" : false,
    "lucene_version" : "6.6.1"
  "tagline" : "You Know, for Search"

That means elasticsearch is working, which means java is working. Now install logstash:

apt-get install logstash

Now you install kibana

apt-get install kibana
vi /etc/kibana/kibana
  server.host: "localhost" <-- change to your actual IP
systemctl restart kibana
systemctl enable kibana
  Synchronizing state of kibana.service with SysV service script with /lib/systemd/systemd-sysv-install.
  Executing: /lib/systemd/systemd-sysv-install enable kibana

Now install filebeat, the thing that sends information to your ELK box to look at.

apt-get install filebeat