ELK Installation

Prerequisite sudo apt update sudo apt install openjdk-8-jdk sudo apt-get install -y nginx sudo systemctl enable nginx You Should be having s...


  1. sudo apt update
  2. sudo apt install openjdk-8-jdk
  3. sudo apt-get install -y nginx
  4. sudo systemctl enable nginx
  5. You Should be having sudo permission 
  6. Run below command without root user (don't use sudo su to run below commands). You can run a command whoami to check that you are not logged in as root user.

Install Elastic Search

  1. wget
  2. sudo dpkg -i elasticsearch-7.2.0-amd64.deb

Install kibana

  1. sudo wget
  2. sudo dpkg -i kibana-7.2.0-amd64.deb

Install Logstash

  1. sudo wget
  2. sudo dpkg -i logstash-7.2.0.deb

Install Dependencies

  1. sudo apt-get install -y apt-transport-https

Install FileBeat

  1. wget
  2. sudo dpkg -i filebeat-7.2.0-amd64.deb

Modify elasticsearch yaml file

  1. sudo vi /etc/elasticsearch/elasticsearch.yml
  2. Make below changes in this file my-application node-1

http.port: 9200 localhost

  1. sudo systemctl start elasticsearch

Modify Kibana yaml file

  1. sudo vi /etc/kibana/kibana.yml
  2. Make below changes in the file
server.port: 5601 "localhost"
  1. sudo systemctl start kibana

  2. sudo apt-get install -y apache2-utils

  3. sudo htpasswd -c /etc/nginx/htpasswd.users kibadmin

  4. sudo vi /etc/nginx/sites-available/default

  server {
    listen 80;


    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/htpasswd.users;

    location / {
        proxy_pass http://localhost:5601;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
  1. sudo systemctl restart nginx

Download Some sample data

1.sudo wget

 2. sudo mv sample-data apache.log

 3. vi /etc/logstash/conf.d/apache.conf

input {
 file {
   path => "/home/ubuntu/apache.log"
   start_position => "beginning"
   sincedb_path => "/dev/null"
filter {
      grok {
         match => {  "message" => "%{COMBINEDAPACHELOG}" }
      date {
         match => [ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z" ]
      geoip {
         source => "clientip"
output {
  elasticsearch {
  hosts => ["localhost:9200"]
  index => "petclinic-prd-1"
  1. sudo systemctl restart logstash

Getting data from filebeat

  1. sudo filebeat modules list
  2. sudo filebeat modules enable nginx
  3. sudo filebeat modules enable system
  4. cd /etc/filebeat/modules.d/
  5. sudo vi nginx.yml
    enabled: true
    var.paths: ["/var/log/nginx/access.log*"]

  # Error logs
    enabled: true
    var.paths: ["/var/log/nginx/error.log*"]
  1. sudo vi system.yml
- module: system
  # Syslog
    enabled: true
    var.paths: ["/var/log/syslog*"]
    enabled: true
    var.paths: ["/var/log/auth.log*"]
  1. sudo systemctl restart filebeat
  2. sudo systemctl restart logstash



Ansible,6,AWS,1,Azure DevOps,1,Containerization with docker,2,DevOps,2,Docker Quiz,1,Docker Swarm,1,DockerCompose,1,ELK,2,git,2,Jira,1,Kubernetes,1,Kubernetes Quiz,5,SAST DAST Security Testing,1,SonarQube,3,Splunk,2,vagrant kubernetes,1,YAML Basics,1,
DevOpsWorld: ELK Installation
ELK Installation
Loaded All Posts Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS PREMIUM CONTENT IS LOCKED STEP 1: Share to a social network STEP 2: Click the link on your social network Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy Table of Content