How To Install ELK Stack on CentOS 7

Install ELK Stack on CentOS 7

In this tutorial we will show you how to install ELK Stack on CentOS 7 server. For those of you who didn’t know, ELK stack is a popular, open source log management platform. It is used as a centralized management for storing, analyzing and viewing of logs. Centralized management makes it easier to study the logs & identify issues if any for any number of servers.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo’ to the commands to get root privileges. I will show you through the step by step install ELK Stack (Elasticsearch, Logstash and Kibana) on CentOS 7 server.

Install ELK Stack on CentOS 7

Step 1. First let’s start by ensuring your system is up-to-date.

Step 2. Installing Java.

You need a Java Runtime Environment (JRE) because Elasticsearch is written in Java programming language, you can install OpenJDK package that includes JRE:

Verify the Java version:

Step 3. Installing Elasticsearch.

Elasticsearch can be installed with a package manager by adding Elastic’s package repository:

Then install the RPM package that you just downloaded:

Start and enable the service:

Now run the following command from the terminal to check if the elasticsearch is working properly:

You should get the following output:

Step 4. Installing Kibana.

Install Kibana is very simple, you can easily install it using an RPM package:

Now just execute the following command so you can start the Kibana service:

Kibana is now installed and working on our system. To check the web-page, open the web browser & go to the URL mentioned below (use the IP address for your ELK host):

Step 5. Configure ELK stack.

First, we need to create an SSL certificate. This certificate will be used for securing communication between logstash & filebeat clients. Before creating a SSL certificate, we will make an entry of our server IP address in openssl.cnf:

Look for section with ‘subjectAltName’ & add your server IP to it:

Now change the directory to /etc/ssl and create SSL certificate:

Step 6. Configure Logstash.

We will now create a configuration file for logstash under the folder ‘/etc/logstash/conf.d‘:

Next section i.e. ‘filter section’ will parse the logs before sending them to elasticsearch:

Last section is ‘output section’ & it defines the location for the storage of logs:

Now save the file and exit. Now start the logstash service & enable it at boot time:

Step 7. Installing Filebeat on Clients.

Now to be able to communicate with the ELK stack, Filebeat needs to installed on all the client machines:

Now install filebeat using following command:

After the filebeat has been installed, copy the ssl certificate from the ELK stack server to ‘/etc/ssl’. Next we will make changes to filebeat configuration file to connect the client to ELK server:

Make the following changes to file:

Now start the service and enable it at boot time:

Configurations on both server end and client end are now complete. We can now login to the kibana web interface to look for analysed logs.

Congratulation’s! You have successfully installed ELK Stack on CentOS 7. Thanks for using this tutorial for installing ELK Stack (Elasticsearch, Logstash and Kibana) on CentOS 7 systems. For additional help or useful information, we recommend you to check the official ELK Stack web site.

VPS Manage Service Offer
If you don’t have time to do all of this stuff, or if this is not your area of expertise, we offer a service to do “VPS Manage Service Offer”, starting from $10 (Paypal payment). Please contact us to get a best deal!