Configure ELK Stack (Linux)




Pre-requisites:

  1. Jdk-1.8

  2. Maven -3.6.0+

JDK Setup

Step-1: Download JDK

Download JDK from the following link:
https://www.dropbox.com/s/yocl0brjlslxrjw/jdk-8u331-linux-x64.tar?dl=0


Can copy from local to the remote machine using the following

scp jdk-8u331-linux-x64.tar ${username}@${host}:~/

Step-2: Create a Directory

sudo mkdir /usr/lib/jvm

Step-3: Change Directory

cd /usr/lib/jvm

Step-4: Unzip

sudo tar -xvf ~/jdk-8u331-linux-x64.tar.gz


OR


To install OpenJDK, skip the above steps and run the following command

sudo apt update

sudo apt install openjdk-8-jdk

For JDK 11

sudo apt install openjdk-11-jdk

Step-5: Edit the environment file

sudo vi /etc/environment

Environment file after modification

PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/usr/lib/jvm/jdk1.8.0_331/bin:/usr/lib/jvm/jdk1.8.0_331/db/bin:/usr/lib/jvm/jdk1.8.0_331/jre/bin"

J2SDKDIR="/usr/lib/jvm/jdk1.8.0_331"

J2REDIR="/usr/lib/jvm/jdk1.8.0_331/jre"

JAVA_HOME="/usr/lib/jvm/jdk1.8.0_331"

DERBY_HOME="/usr/lib/jvm/jdk1.8.0_331/db"


Step-6: Execute the following commands to reflect the changes above

Note: Paths will vary depending on your java installation directory


sudo update-alternatives --install "/usr/bin/java" "java" "/usr/lib/jvm/jdk1.8.0_331/bin/java" 0

sudo update-alternatives --install "/usr/bin/javac" "javac" "/usr/lib/jvm/jdk1.8.0_331/bin/javac" 0

sudo update-alternatives --set java /usr/lib/jvm/jdk1.8.0_331/bin/java

sudo update-alternatives --set javac /usr/lib/jvm/jdk1.8.0_331/bin/javac

Step-7: Confirm installation with checking java version

java -version


Maven Setup

Step-1: Update the package index

sudo apt update

Step-2: Install maven

sudo apt install maven

Step-3: Check the maven version

mvn -version



Elasticsearch Setup

Step-1: Import the PGP key for Elastic:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

Step-2: Install the apt-transport-https package:

sudo apt-get install apt-transport-https

Step-3: Add the Elastic repository to your system’s repository list:

echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee –a /etc/apt/sources.list.d/elastic-7.x.list

Step-4: Update package:

sudo apt-get update

Step-5: Install elasticsearch:

sudo apt-get install elasticsearch

Step-6: Configure elasticsearch by editing the following file

sudo vi /etc/elasticsearch/elasticsearch.yml


Update the following fields as below

network.host: 0.0.0.0

http.port: 9200

Add the following

discovery.type: single-node


Step-7: Start elasticsearch service

sudo systemctl start elasticsearch.service

Step-8: Enable Elasticsearch to start on boot

sudo systemctl enable elasticsearch.service

Step-8: Test Elasticsearch

curl -X GET "localhost:9200"

A successful configuration will show result as below


Kibana Setup

Step-1: Install Kibana

sudo apt-get install kibana

Step-2: Configure kibana by updating the following file

sudo vi /etc/kibana/kibana.yml

Uncomment (by removing #) the following properties and configure as follows

server.port: 5601

server.host: 0.0.0.0

elasticsearch.hosts: ["http://localhost:9200"]


After modification it will look like this


Step-3: Start Kibana

sudo systemctl start kibana

Step-4: Enable Kibana to start on boot

sudo systemctl enable kibana

Step-5: Allow Traffic on Port 5601

sudo ufw allow 5601/tcp

Step-6: Test Kibana

http://localhost:5601


Logstash Setup

Step-1: Install Logstash

sudo apt-get install logstash

Step-2: Start Logstash

sudo systemctl start logstash

Step-3: Enable Logstash

sudo systemctl enable logstash

Step-4: Check the status of Logstash

sudo systemctl status logstash

It will look like this

Step-5: Configure Logstash

All the configuration files must be placed at /etc/logstash/conf.d/


Create new configuration file using following command

sudo vi /etc/logstash/conf.d/logstash.conf

Add the following configuration, save and close the file

input {

  file {

    path => "/users/ssmtariq/elk-demo/logs/elk-stack.log"

        start_position => "beginning"

  }

}


output {

  elasticsearch {

    hosts => ["localhost:9200"]

  }

  stdout { codec => rubydebug }

}


Note: The path will be exact full path of the log file


Elasticsearch Index Retrieval

After running the application all the index’s of elasticsearch can be found using the following url

http://{host}:9200/_cat/indices



Comments