Step-by-Step Guide to Installing the ELK Stack on Linux

Introduction

The Elastic Stack (ELK) is not a single product but a collection of open‑source tools—Elasticsearch, Logstash, Kibana, and Filebeat—used for centralized log collection, search, analysis, and visualization.

Components

Elasticsearch : distributed full‑text search engine.

Logstash : log collection, processing and storage.

Kibana : web UI for filtering and visualizing logs.

Filebeat : lightweight agent that forwards log files.

Test Environment Layout

IP addresses and hostnames are planned as shown in the diagram; all hosts have synchronized time, and the test‑environment firewall is disabled.

Installation Procedure

3.1 Basic Environment Check

[root@elk ~]# hostname elk.test.com

[root@elk ~]# cat /etc/hosts

Verify that the hosts file contains entries for the ELK nodes and related services.

3.2 Required Packages

[root@elk elk]# wget -c https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/rpm/elasticsearch/2.3.3/elasticsearch-2.3.3.rpm

[root@elk elk]# wget -c https://download.elastic.co/logstash/logstash/packages/centos/logstash-2.3.2-1.noarch.rpm

[root@elk elk]# wget https://download.elastic.co/kibana/kibana/kibana-4.5.1-1.x86_64.rpm

[root@elk elk]# wget -c https://download.elastic.co/beats/filebeat/filebeat-1.2.3-x86_64.rpm

3.3 Package Verification

[root@elk elk]# ls elasticsearch-2.3.3.rpm filebeat-1.2.3-x86_64.rpm kibana-4.5.1-1.x86_64.rpm logstash-2.3.2-1.noarch.rpm

The server only needs Elasticsearch, Logstash, and Kibana; the client only needs Filebeat.

3.4 Install Elasticsearch (requires JDK)

[root@elk elk]# yum install java-1.8.0-openjdk -y

[root@elk elk]# yum localinstall elasticsearch-2.3.3.rpm -y

# Enable and start the service

sudo systemctl daemon-reload

sudo systemctl enable elasticsearch.service

sudo systemctl start elasticsearch.service

3.5 Verify Elasticsearch Service

[root@elk elk]# netstat -nltp | grep java

Open ports 9200 and 9300 in the firewall:

firewall-cmd --permanent --add-port={9200/tcp,9300/tcp}

firewall-cmd --reload

3.6 Install Kibana

[root@elk elk]# yum localinstall kibana-4.5.1-1.x86_64.rpm -y

systemctl enable kibana

systemctl start kibana

Check Kibana status (default process name node, port 5601): netstat -nltp | grep 5601 Open port 5601 in the firewall:

firewall-cmd --permanent --add-port=5601/tcp

firewall-cmd --reload