In this tutorial we will show you how to install ELK Stack on Debian 9. For those of you who didn’t know, ELK stack is a popular, open source log management platform. It is used as a centralized management for storing, analyzing and viewing of logs. Centralized management makes it easier to study the logs and identify issues if any for any number of servers.
This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo’ to the commands to get root privileges. I will show you through the step by step installation ELK Stack on a Debian 9 (Stretch) server.
Install ELK Stack on Debian 9 Stretch
Step 1. Before we install any software, it’s important to make sure your system is up to date by running these following apt-get commands in the terminal:
1 2 3 | apt-getupdate apt-getupgrade apt-getinstallapt-transport-httpssoftware-properties-commonwget |
Elasticsearch requires at least Java 8 in order to run, You can install OpenJDK package that includes JRE:
1 | aptinstallopenjdk-8-jdk |
Verify the Java version:
1 2 3 4 | [root@idroot.us~]# java -version openjdkversion"1.8.0_171" OpenJDKRuntimeEnvironment(build1.8.0_171-8u171-b11-1~deb9u1-b11) OpenJDK64-BitServerVM(build25.171-b11,mixedmode) |
First, install Elasticsearch using the apt package manager from the official Elastic repository:
1 2 3 | wget-qO-https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add - echo"deb https://artifacts.elastic.co/packages/6.x/apt stable main"|sudotee-a/etc/apt/sources.list.d/elastic-6.x.list sudoapt-getupdate |
Then, install Elasticsearch with apt using the following command:
1 | apt-getinstallelasticsearch |
Start the Elasticsearch service and set it to automatically start on boot:
1 2 | systemctlrestartelasticsearch systemctlenableelasticsearch |
Now run the following command from the terminal to check if the elasticsearch is working properly:
1 | curl-XGEThttp://localhost:9200 |
You should get the following output:
1 2 3 4 5 6 7 8 9 10 11 12 13 | { "name":"idroot.us", "cluster_name":"elasticsearch", "cluster_uuid":"k27ZZFBMWe46aOtwg6_pyzEiw", "version":{ "number":"6.2.4", "build_hash":"2cfe0df", "build_date":"2018-05-29T16:05:51.443Z", "build_snapshot":false, "lucene_version":"7.2.1" }, "tagline":"You Know, for Search" } |
First, install the latest version of Kibana using the apt package manager from the official Elastic repository:
1 | apt-getinstallkibana |
Once the installation is completed, open the kibana.yml file and restrict the remote access to the Kibana instance:
1 2 3 4 5 6 | nano/etc/kibana/kibana.yml # Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values. # The default is 'localhost', which usually means remote machines will not be able to connect. # To allow connections from remote users, set this parameter to a non-loopback address. server.host:"localhost" |
Start the Kibana service and set it to start automatically on boot:
1 2 | systemctlstartkibana systemctlenablekibana |
Next, use Nginx as a reverse proxy to access Kibana from the public IP address. To install Nginx, run:
1 | apt-getinstallnginx |
Create a basic authentication file with the openssl command:
1 | echo"admin:$(openssl passwd -apr1 YourPassword)"|sudotee-a/etc/nginx/htpasswd.kibana |
Then, create a virtual host configuration file for the Kibana instance:
1 2 | rm-f/etc/nginx/sites-enabled/default nano/etc/nginx/sites-available/kibana |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 | server{ listen80default_server; server_name_; return301https://$server_name$request_uri; } server{ listen443default_serversslhttp2; server_name_; ssl_certificate/etc/ssl/certs/ssl-cert-snakeoil.pem; ssl_certificate_key/etc/ssl/private/ssl-cert-snakeoil.key; ssl_session_cacheshared:SSL:10m; auth_basic"Restricted Access"; auth_basic_user_file/etc/nginx/htpasswd.kibana; location/{ proxy_passhttp://localhost:5601; proxy_http_version1.1; proxy_set_headerUpgrade$http_upgrade; proxy_set_headerConnection'upgrade'; proxy_set_headerHost$host; proxy_cache_bypass$http_upgrade; } } |
Creating a symbolic link and test the Nginx configuration:
1 2 | ln-s/etc/nginx/sites-available/kibana/etc/nginx/sites-enabled/kibana nginx-t |
Restart the Nginx service and set it to start automatically on boot:
1 2 | systemctlrestartnginx systemctlenablenginx |
Install Logstash using the apt package manager from the official Elastic repository:
1 | apt-getinstalllogstash |
Once the Logstash package is installed start the Logstash service and set it to start automatically on boot:
1 2 | systemctlrestartlogstash systemctlenablelogstash |
You can now access the kibana interface by opening your browser and typing:
1 | https://YourIpAddress |
Congratulation’s! You have successfully installed Skype. Thanks for using this tutorial for installing ELK (Elasticsearch, Logstash and Kibana) on Debian 9 Stretch system. For additional help or useful information, we recommend you to check the official ELK Stack on web site.
