Elastic Search & Kibana Including Log stash and Beats
Configuration of Elastic Search & Kibana Including Log stash and Beats
There is flow of data collection to visualization that is described in the picture
Before Configuration of ELK there are some Prerequisites
A Linux system running Ubuntu 20.04 or 18.04
Access to a terminal window/command line (Search > Terminal)
A user account with sudo or root privileges
Install Java
java -version
sudo apt-get install openjdk-8-jdk
Install Nginx
sudo apt-get install nginx
Add Elastic Repository
wget –qO – https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add –
install the apt-transport-https package:
sudo apt-get install apt-transport-https
Add the Elastic repository to your system’s repository list
echo “deb https://artifacts.elastic.co/packages/7.x/apt stable main” | sudo tee –a /etc/apt/sources.list.d/elastic-7.x.list
Install Elasticsearch
sudo apt-get update
sudo apt-get install elasticsearch
sudo nano /etc/elasticsearch/elasticsearch.yml
Comment:Uncomment the lines by deleting the hash (#
) sign at the beginning of both lines and replace 192.168.0.1
with localhost
.
For configuring a single node cluster
discovery.type: single-node
sudo nano /etc/elasticsearch/jvm.options
(size is set to 512MB)
Start Elasticsearch
sudo systemctl start elasticsearch.service
sudo systemctl enable elasticsearch.service
Test service
curl –X GET “localhost:9200”
Install Kibana
sudo nano /etc/kibana/kibana.yml
server.port: 5601
server.host: “localhost”
elasticsearch.hosts: [“http://localhost:9200”]
sudo systemctl start kibana
sudo systemctl enable kibana
sudo ufw allow 5601/tcp
http://localhost:port
Install Logstash
sudo apt-get install Logstash
sudo systemctl start Logstash
sudo systemctl enable Logstash
sudo systemctl status logstash
Install Filebeat
sudo atp-get install filebeat
sudo nano /etc/filebeat/filebeat.yml
Add these to file
output.logstash
output.logstash
hosts: ["localhost:5044"]
sudo filebeat modules enable system
sudo filebeat setup --index-management –E output.logstash.enabled=false –E 'output.elasticsearch.hosts=["localhost:9200"]'
sudo systemctl start filebeat
sudo systemctl enable filebeat
curl -XGET http:// localhost:port/_cat/indices?v
Comments
Post a Comment