Step-by-Step Guide to Deploy ELK Stack with Kibana, Logstash, and Filebeat on Linux

Open firewall for Kibana

firewall-cmd --permanent --add-port=5601/tcp
firewall-cmd --reload
firewall-cmd --list-all

Verify that port 5601 appears in the listed ports.

Install and start Kibana

yum localinstall kibana-4.5.1-1.x86_64.rpm -y
systemctl enable kibana
systemctl start kibana
systemctl status kibana

Check that Kibana is running (listening on port 5601) and open http://<em>your‑host</em>:5601/ in a browser.

Forward port 80 to 5601

firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=5601
firewall-cmd --reload

Install Logstash and generate SSL certificates

yum localinstall logstash-2.3.2-1.noarch.rpm -y
cd /etc/pki/tls/
openssl req -subj '/CN=elk.test.com/' -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout private/logstash-forwarder.key -out certs/logstash-forwarder.crt

Create Logstash configuration (listening on port 5000)

Place the configuration file in /etc/logstash/conf.d/ and ensure it defines input on port 5000.

Open firewall for Logstash port 5000

firewall-cmd --permanent --add-port=5000/tcp
firewall-cmd --reload

Configure Elasticsearch

# Example /etc/elasticsearch/es-01/elasticsearch.yml
http:
  port: 9200
network:
  host: elk.test.com
node:
  name: elk.test.com
path:
  data: /etc/elasticsearch/data/es-01

Restart Elasticsearch and Logstash services

systemctl restart elasticsearch
systemctl restart logstash

Deploy Filebeat to client nodes

scp filebeat-1.2.3-x86_64.rpm [email protected]:/root/elk
scp filebeat-1.2.3-x86_64.rpm [email protected]:/root/elk
scp logstash-forwarder.crt rsyslog.test.com:/root/elk
scp logstash-forwarder.crt nginx.test.com:/root/elk

Install and configure Filebeat on each client

yum localinstall filebeat-1.2.3-x86_64.rpm -y
cp logstash-forwarder.crt /etc/pki/tls/certs/
# Edit filebeat.yml to point to the Logstash server and configure desired log files in conf.d/*.yml
service filebeat start
chkconfig filebeat on

Use netstat -altp to confirm that Filebeat is listening and that connections to the ELK server are established.

Verify the setup

Open http://192.168.30.67:5601/ in a browser; the Kibana dashboard should display logs collected from the client nodes.

View system logs on the two machines (node1 and node2) to confirm that logs are being forwarded and indexed correctly.

Overall experience: the ELK stack provides a fast, integrated solution for log collection, storage, and visualization, and can be extended with Kafka for scalable log pipelines.