Step‑by‑Step Guide to Install a Single‑Node EFK Stack (Elasticsearch, Filebeat, Kibana)

EFK Installation (Single Node) – Elasticsearch, Filebeat, Kibana

Prerequisites: JDK 17 installed, CentOS 7, at least 2 GB RAM, and network access to the target IPs.

192.168.25.149 – Elasticsearch + Kibana (CPU 2, 2 GB RAM)

192.168.25.148 – Filebeat (CPU 2, 2 GB RAM)

1. Install Elasticsearch on 192.168.25.149

Configure the Elastic yum repository, import the GPG key, and install the package.

# Configure Elastic official repository
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
sudo tee /etc/yum.repos.d/elastic.repo <<EOF
[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

# Install Elasticsearch
sudo yum install -y elasticsearch

# Edit /etc/elasticsearch/elasticsearch.yml
cluster.name: elk-cluster
node.name: node-1
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 192.168.25.149
http.port: 9200
discovery.type: single-node

# Adjust JVM heap (server has only 2 GB RAM)
sudo vim /etc/elasticsearch/jvm.options
-Xms512m
-Xmx512m

Start and enable the service, stop the firewall, and verify the installation.

# Reload systemd, enable and start Elasticsearch
sudo systemctl daemon-reload
sudo systemctl enable elasticsearch
sudo systemctl start elasticsearch

# Disable firewalld (optional)
systemctl stop firewalld

# Verify
curl http://192.168.25.149:9200

2. Install Kibana on 192.168.25.149

# Install Kibana
sudo yum install -y kibana

# Edit /etc/kibana/kibana.yml
server.port: 5601
server.host: "192.168.25.149"
elasticsearch.hosts: ["http://192.168.25.149:9200"]
i18n.locale: "zh-CN"  # Chinese UI

Enable and start Kibana.

# Enable and start Kibana
sudo systemctl enable kibana
sudo systemctl start kibana

3. Install Filebeat on 192.168.25.148

Configure the Elastic yum repository (same as above) and install Filebeat.

# Install Filebeat
sudo yum install -y filebeat

# Edit /etc/filebeat/filebeat.yml
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /usr/loca/project/wcc/logs/info.log
    tags: ["info"]
    fields:
      logtype: info
    fields_under_root: true

  - type: log
    enabled: true
    paths:
      - /usr/loca/project/wcc/logs/error.log
    tags: ["error"]
    fields:
      logtype: error
    fields_under_root: true

output.elasticsearch:
  hosts: ["192.168.25.149:9200"]
  indices:
    - index: "wcc-info-%{+yyyy.MM.dd}"
      when.equals:
        logtype: "info"
    - index: "wcc-error-%{+yyyy.MM.dd}"
      when.equals:
        logtype: "error"

setup.template.name: "wcc"
setup.template.pattern: "wcc-*"
setup.ilm.enabled: false

Enable and start Filebeat.

# Enable and start Filebeat
sudo systemctl enable filebeat
sudo systemctl start filebeat

4. Configure Kibana Index Pattern

Open a browser and navigate to http://192.168.25.149:5601. In Kibana go to Stack Management → Index Patterns , create a new pattern wcc-*, and select @timestamp as the time field.

After the index pattern is created, you can explore logs via the Discover tab and build visualizations on the dashboard.