Step-by-Step ELK Stack Installation and Configuration Guide

This guide walks through installing and configuring the ELK stack (Elasticsearch, Logstash, Kibana) on an Ubuntu system, starting with the required Java runtime.

Java installation

Add the WebUpd8 PPA for Oracle Java:

su -
 echo "deb http://ppa.launchpad.net/webupd8team/java/ubuntu trusty main" | tee -a /etc/apt/sources.list
 echo "deb-src http://ppa.launchpad.net/webupd8team/java/ubuntu trusty main" | tee -a /etc/apt/sources.list
 apt-key adv --keyserver keyserver.ubuntu.com --recv-keys EEA14886
 apt-get update
 apt-get install oracle-java8-installer

Verify the installation:

java -version
 javac -version

Optional: automatically accept the Oracle JDK8 license and set environment variables:

echo oracle-java7-installer shared/accepted-oracle-license-v1-1 true | sudo debconf-set-selections
 sudo apt-get install -y oracle-java8-set-default

Elasticsearch installation and configuration

Add the Elasticsearch GPG key and repository for the 5.x series:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
 echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-5.x.list
 sudo apt-get update
 sudo apt-get install elasticsearch

Edit /etc/elasticsearch/elasticsearch.yml with the following settings:

cluster.name: es_cluster_nik
node.name: nik
path.data: /tmp/elasticsearch/data
path.logs: /tmp/elasticsearch/logs
network.host: 0.0.0.0
http.port: 9200

Start the Elasticsearch service:

service elasticsearch start

Logstash installation and configuration

Install Logstash:

sudo apt-get install logstash

Create a test configuration file (e.g., /etc/logstash/conf.d/test.conf) that reads from standard input and writes to Elasticsearch with rubydebug output:

input { stdin { } }
output {
  elasticsearch { hosts => "localhost:9200" index => "logstash_test" }
  stdout { codec => rubydebug }
}

Run Logstash with the test file:

/opt/logstash/bin/logstash -f /etc/logstash/conf.d/test.conf

Type any string (e.g., teststring and so on) and observe the JSON output.

Kibana installation and configuration

Install Kibana (5.x):

sudo apt-get install kibana

Edit /etc/kibana/kibana.yml:

server.port: 5601
server.host: "192.168.1.10"
elasticsearch.url: http://192.168.1.10:9200

Start Kibana:

service kibana start

Verification

Query Elasticsearch to confirm Logstash indexed a document:

http://192.168.1.10:9200/logstash_test/_search

The default index pattern can be accessed at http://192.168.1.10:9200/logstash-YYYY.MM.DD. Optional basic authentication can be configured by adding user => "logstash_internal" and password => "changeme" to the Logstash output block.