How To Install ELK Stack on Ubuntu 18.04 LTS

In this tutorial, we will show you how to install ELK Stack on Ubuntu 18.04 LTS. For those of you who didn’t know, ELK stack is a popular, open-source log management platform. It is used as centralized management for storing, analyzing, and viewing logs. Centralized management makes it easier to study the logs and identify issues if any for any number of servers.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of ELK Stack on an Ubuntu 18.04 (Bionic Beaver) server.

Prerequisites

• A server running one of the following operating systems: Ubuntu 18.04 (Bionic Beaver).
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install ELK Stack on Ubuntu 18.04 LTS Bionic Beaver

Step 1. First, make sure that all your system packages are up-to-date by running the following apt-get commands in the terminal.

sudo apt-get update
sudo apt-get upgrade

Step 2. Installing Java on Ubuntu 18.04 LTS.

Now install Java by using the following command:

apt -y install oracle-java8-installer

Next, you can also set the JAVA_HOME and other defaults by installing oracle-java8-set-default:

apt -y install oracle-java8-set-default

Then, You can now verify if the JAVA_HOME variable is set by running:

echo "$JAVA_HOME"

Verify the Java version:

[root@idroot.us ~]# java -version
openjdk version "1.8.0_181"
OpenJDK Runtime Environment (build 1.8.0_181-8u181-b11-1~deb9u1-b11)
OpenJDK 64-Bit Server VM (build 25.181-b11, mixed mode)

Step 3. Installing Elasticsearch on Ubuntu 18.04 LTS.

First, install Elasticsearch using the apt package manager from the official Elastic repository:

wget -qO - https://packages.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb http://packages.elastic.co/elasticsearch/2.x/debian stable main" | sudo tee -a /etc/apt/sources.list.d/elasticsearch-2.x.list
apt-get update

Then, install Elasticsearch with apt using the following command:

apt-get -y install elasticsearch

Start the Elasticsearch service and set it to automatically start on boot:

systemctl restart elasticsearch
systemctl enable elasticsearch

Elasticsearch is now installed. Edit its configurations now, using the following commands:

nano /etc/elasticsearch/elasticsearch.yml

Step 4. Installing Kibana on Ubuntu 18.04 LTS.

First, create the Kibana source list:

echo "deb http://packages.elastic.co/kibana/4.5/debian stable main" | sudo tee -a /etc/apt/sources.list.d/kibana-4.5.x.list

Now install Kibana with this command:

apt-get update
apt-get -y install kibana

Once the installation is completed, open the kibana.yml file and restrict the remote access to the Kibana instance:

nano /etc/kibana/kibana.yml

# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "localhost"

Start the Kibana service and set it to start automatically on boot:

systemctl start kibana
systemctl enable kibana

Step 5. Installing Logstash on Ubuntu 18.04 LTS.

First, create the Logstash source list:

echo 'deb http://packages.elastic.co/logstash/2.2/debian stable main' | sudo tee /etc/apt/sources.list.d/logstash-2.2.x.list

Next, Install Logstash using the apt package manager:

apt-get install logstash

Once the Logstash package is installed start the Logstash service and set it to start automatically on boot:

systemctl restart logstash
systemctl enable logstash

Step 6. Install and configure Nginx as a reverse proxy.

Next, use Nginx as a reverse proxy to access Kibana from the public IP address. To install Nginx, run:

apt-get install nginx

Create a basic authentication file with the OpenSSL command:

echo "admin:`openssl passwd -apr1 YourPasswd`" | sudo tee -a /etc/nginx/htpasswd.kibana

Then, create a virtual host configuration file for the Kibana instance:

rm -f /etc/nginx/sites-enabled/default
nano /etc/nginx/sites-available/kibana

server {
listen 80 default_server;
server_name _;
return 301 https://$server_name$request_uri;
}

server {
listen 443 default_server ssl http2;

server_name _;

ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
ssl_session_cache shared:SSL:10m;

auth_basic "Restricted Access";
auth_basic_user_file /etc/nginx/htpasswd.kibana;

location / {
proxy_pass http://localhost:5601;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}

Creating a symbolic link and testing the Nginx configuration:

ln -s /etc/nginx/sites-available/kibana /etc/nginx/sites-enabled/kibana
nginx -t

Restart the Nginx service and set it to start automatically on boot:

systemctl restart nginx
systemctl enable nginx

Step 7. Accessing Kibana.

You can now access the Kibana interface by opening your browser and typing:

https://your-server-ip-address

Congratulations! You have successfully installed ELK Stack. Thanks for using this tutorial for installing ELK Stack on your Ubuntu 18.04 LTS Bionic Beaver. For additional help or useful information, we recommend you check the official ELK Stack website.