How To Install ELK Stack on AlmaLinux 8

In this tutorial, we will show you how to install ELK Stack on AlmaLinux 8. For those of you who didn’t know, The ELK Stack is an acronym for a combination of three widely used open-source projects: E=Elasticsearch, L=Logstash, and K=Kibana. With the addition of Beats, the ELK Stack is now known as the Elastic Stack. the ELK platform allows you to consolidate, process, monitor, and perform analytics on data generated from multiple sources in a way that is fast, scalable, and reliable.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the ELK Stack on an AlmaLinux 8. You can follow the same instructions for Rocky Linux.

Prerequisites

• A server running one of the following operating systems: AlmaLinux 8, CentOS, or Rocky Linux 8.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install ELK Stack on AlmaLinux 8

Step 1. First, let’s start by ensuring your system is up-to-date.

sudo dnf update
sudo dnf install epel-release
sudo dnf --enablerepo=epel group

Step 2. Installing Java.

Elasticsearch depends on Java and it has to be installed on the system by using the following command:

sudo dnf install java-11-openjdk-devel

Check the Java version once the installation is completed:

java -version

Step 3. Installing Elasticsearch on AlmaLinux 8.

By default, Elasticsearch is not available on AlmaLinux 8 base repository. Now install the GPG key for the Elasticsearch rpm packages:

rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

Then, create a yum repository file for the Elasticsearch:

nano /etc/yum.repos.d/elasticsearch.repo

Add the following line:

[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

Once is done, install the Elasticsearch package by using the following command below:

sudo dnf update
sudo dnf install elasticsearch

After installation is complete we need to start the Elasticsearch server to start operating. We do that with the following command below:

sudo systemctl start elasticsearch
sudo systemctl enable elasticsearch
sudo systemctl status elasticsearch

Verify that Elasticsearch is running as expected:

curl -X GET "localhost:9200"

Output:

[root@idroot ~]# curl -X GET "localhost:9200/"
{
  "name" : "idroot",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "5umeiTVNkimpo1eiUw",
  "version" : {
    "number" : "7.14.0",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "5ca8591c6fcdbgodet95b08a8e023559635c6f3",
    "build_date" : "2022-01-04T12:11:25.0817410060Z",
    "build_snapshot" : false,
    "lucene_version" : "8.8.8",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

Step 4. Installing Kibana.

Kibana is a visual interface for Elasticsearch that allows us to search and visualize our data. Now run the following command below to install it:

sudo dnf install kibana

After installation, we need to configure Kibana to allow remote access, I shall configure Kibana to listen to any IP:

sudo nano /etc/kibana/kibana.yml

Add the following file:

server.host: "0.0.0.0"
server.name: "idroot-almalinux"
elasticsearch.url: "http://localhost:9200"

Next, start the Kibana server to start operating. We do that with the following command below:

sudo systemctl enable --now kibana

Step 5. Installing Logstash.

Now we run the following command to install Logstash to your AlmaLinux system:

sudo dnf install logstash

Next, we custom configuration required to point the Logstash application to the Elasticsearch application that is running on the same host on port 9200:

sudo nano /etc/logstash/conf.d/logstash.conf

Add the following file:

input {
  beats {
    port => 5044
  }
}
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
  }
}

Finally, start the Logstash service and get it automatically started with the system:

sudo systemctl start logstash
sudo systemctl enable logstash

Step 6. Installing and Configuring Filebeat.

Filebeat is one of the most popular Beats among ELK stack users, which is designed to read a large number of files. To install Filebeat on  AlmaLinux 8, run the command below:

sudo dnf install filebeat

Filebeat comprises modules that are used to ship different types of logs on Linux systems. You can list the available modules and enable them according to what you wish to enable:

sudo filebeat modules list

To enable a module, run the command below specifying the module you wish to enable:

sudo filebeat modules enable [module]

Next, start the Filebeat service and make it auto-start with the system:

sudo systemctl start filebeat
sudo systemctl enable filebeat

Step 7. Accessing ELK Dashboard Interface.

Once successfully installed, open your web browser and type the URL https://your-IP-address:5601 to access the YetiForce web UI. You should see the following screen:

Congratulations! You have successfully installed ELK Stack. Thanks for using this tutorial for installing the ELK Stack on your AlmaLinux 8 system. For additional help or useful information, we recommend you check the official ELK Stack website.