How To Install ELK Stack on Ubuntu 20.04 LTS

In this tutorial, we will show you how to install ELK Stack on Ubuntu 20.04 LTS. For those of you who didn’t know, ELK stack is a popular, open-source log management platform. It is used as centralized management for storing, analyzing, and viewing logs. Centralized management makes it easier to study the logs and identify issues if any for any number of servers.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of ELK Stack on an Ubuntu 20.04 Focal Fossa server.

Prerequisites

• A server running one of the following operating systems: Ubuntu 20.04, 18.04, and any other Debian-based distribution like Linux Mint or elementary OS.
• It’s recommended that you use a fresh OS install to prevent any potential issues.
• SSH access to the server (or just open Terminal if you’re on a desktop).
• A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install ELK Stack on Ubuntu 20.04 LTS Focal Fossa

Step 1. First, make sure that all your system packages are up-to-date by running the following apt commands in the terminal.

sudo apt update
sudo apt upgrade

Step 2. Installing Java on Ubuntu.

Logstash requires Java 8 or Java 11. Install OpenJDK 11 using the following command:

apt install openjdk-11-jdk

Verify the Java version:

[root@idroot.us ~]# java -version

openjdk 11.0.7 2020-04-15
OpenJDK Runtime Environment (build 11.0.7+10-post-Ubuntu-3ubuntu1)
OpenJDK 64-Bit Server VM (build 11.0.7+10-post-Ubuntu-3ubuntu1, mixed mode, sharing)

Step 3. Installing Elasticsearch on Ubuntu.

Follow these steps to get the repository added to your system:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

Next, create the following file:

sudo nano /etc/apt/sources.list.d/elastic.list

deb https://artifacts.elastic.co/packages/6.x/apt stable main

Finally, you can update apt now that the repository is added:

sudo apt update

Then, install Elasticsearch with apt using the following command:

sudo apt install elasticsearch kibana

Next, you need to edit the Kibana configuration file to set the host server as localhost:

sudo nano /etc/kibana/kibana.yml

server.host: "localhost"

Save the configuration file and exit it. Then, restart Kibana and Elasticsearch services:

sudo systemctl restart kibana
sudo systemctl start elasticsearch

Step 4. Install and configure Nginx.

To configure Nginx with SSL to Proxy connection to Kibana, you need to generate the SSL/TLS certificates and create an Nginx configuration file to define Kibana settings:

sudo apt install nginx

Next, create a basic authentication file with the OpenSSL command:

echo "admin:`openssl passwd -apr1 YourPasswd`" | sudo tee -a /etc/nginx/htpasswd.kibana

Then, create a virtual host configuration file for the Kibana instance:

rm -f /etc/nginx/sites-enabled/default
nano /etc/nginx/sites-available/kibana

server {
listen 80 default_server;
server_name _;
return 301 https://$server_name$request_uri;
}

server {
listen 443 default_server ssl http2;

server_name _;

ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
ssl_session_cache shared:SSL:10m;

auth_basic "Restricted Access";
auth_basic_user_file /etc/nginx/htpasswd.kibana;

location / {
proxy_pass http://localhost:5601;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
}

Creating a symbolic link and testing the Nginx configuration:

ln -s /etc/nginx/sites-available/kibana /etc/nginx/sites-enabled/kibana
nginx -t

Restart the Nginx service and set it to start automatically on boot:

systemctl restart nginx
systemctl enable nginx

If UFW is running, allow Nginx connections, both HTTP and HTTPS:

ufw allow 'Nginx Full'

Step 7. Accessing Kibana.

You can now access the Kibana interface by opening your browser and typing:

https://Your-Ip-Address

Congratulations! You have successfully installed ELK Stack. Thanks for using this tutorial for installing ELK Stack on your Ubuntu 20.04 LTS Bionic Beaver. For additional help or useful information, we recommend you to check the official ELK Stack website.