Elasticsearch & Kibana Installation

01 System Preparation

bash

sudo su -
hostnamectl set-hostname ELK-SERVER
echo "10.75.1.100 ELK-SERVER elk" >> /etc/hosts
cat /etc/hosts

Install Dependencies

bash

apt update
apt install gnupg2 apt-transport-https curl default-jdk vim nano git net-tools -y
ifconfig
shutdown -r now
sudo apt update -y

02 Install Elasticsearch

Elasticsearch

Distributed search and analytics engine built on Apache Lucene. Stores, searches, and analyzes large volumes of data in near real-time.

Add Elastic Repository

bash

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | \
gpg --dearmor -o /etc/apt/trusted.gpg.d/elastic.gpg
echo "deb https://artifacts.elastic.co/packages/9.x/apt stable main" > /etc/apt/sources.list.d/elastic-9.x.list

Install

bash

apt update
apt install elasticsearch -y

⚠ Save Your Password! During install, Elasticsearch generates a random password for the elastic user. Check console output and save it immediately!

Example Generated Password

O7CPpzkxYb3VFB0cQ*E_

03 Configure Elasticsearch

bash

grep -Ev '^#|^$' /etc/elasticsearch/elasticsearch.yml

Configure JVM Heap Size

bash

echo "-Xms4g
-Xmx4g" > /etc/elasticsearch/jvm.options.d/jvm-heap.options

Update Network Config

bash

cp /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml.bak
sed -i 's/#network.host: 192.168.0.1/network.host: 0.0.0.0/' /etc/elasticsearch/elasticsearch.yml
sed -i 's/#transport.host: 0.0.0.0/transport.host: 0.0.0.0/' /etc/elasticsearch/elasticsearch.yml

04 Start Elasticsearch Service

bash

systemctl daemon-reload
systemctl enable --now elasticsearch
systemctl start elasticsearch
systemctl status elasticsearch

# Verify ports
ss -altnp | grep -E "9200|9300"

Expected Ports:

9200 — HTTP API (REST interface)
9300 — Transport protocol (inter-node communication)

05 Reset Elastic Password

bash

/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -i

Enter Your Custom Password

abcd@1234

Note

The -i flag enables interactive mode — set a custom password instead of generating a random one

06 Verify Elasticsearch

bash

curl https://ELK-SERVER:9200 --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic:abcd@1234

Web Browser Access

URL: https://<SERVER-IP>:9200
Protocol: Must use HTTPS only — not HTTP

bash — monitor logs

tail -f /var/log/elasticsearch/elasticsearch.log

07 Install Kibana

Kibana

Web-based visualization and analytics UI for Elasticsearch data. Provides dashboards, charts, and real-time visualizations.

Data Source: Elasticsearch indices
Supports: Dashboards, saved searches, alerts, ML insights
Integrates With: Filebeat, Metricbeat, Heartbeat, Logstash

bash

apt install kibana -y

08 Configure Kibana

bash

cp /etc/kibana/kibana.yml /etc/kibana/kibana_backup.yml
sed -i 's/#server.port: 5601/server.port: 5601/' /etc/kibana/kibana.yml
sed -i 's/#server.host: "localhost"/server.host: "0.0.0.0"/' /etc/kibana/kibana.yml

Generate Encryption Keys

bash

/usr/share/kibana/bin/kibana-encryption-keys generate

⚠ Important: Copy the generated encryption keys from the output above and add them to the Kibana config file.

bash — add keys to config

echo -e "xpack.encryptedSavedObjects.encryptionKey: a4478a7b06851c9ade28d49dee092733
xpack.reporting.encryptionKey: 01e570c2a747d5af721a54db9462fe51
xpack.security.encryptionKey: 7dd0a309e7818cf32fabf74ae108118b" >> /etc/kibana/kibana.yml

# Verify
grep -Ev '^#|^$' /etc/kibana/kibana.yml

09 Start Kibana Service

bash

systemctl daemon-reload
systemctl enable --now kibana
systemctl start kibana
systemctl status kibana

# Verify port
ss -altnp | grep 5601

10 Kibana Enrollment & Access

bash — generate enrollment token

/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

Example Enrollment Token

eyJ2ZXIiOiI4LjE0LjAiLCJhZHIiOlsiMTAuNzUuMS4xMDA6OTIwMCJdLCJmZ3IiOiI3YTIxMmQ5NzRjZDE2Yjc4YmRkNWUzZTM1NDFkNTU3OTU1ODkxNGFlNmVmNTJiYzZjMGE5ZDM4MTFhNDZkZDZiIiwia2V5IjoiU3gtWjRwa0J4RkQ1WDk4eTNrLXo6MVlBYWo0RFFGM2Flel8zcjhEZElHUSJ9

bash — get verification code

/usr/share/kibana/bin/kibana-verification-code

Access Kibana Web Interface

URL: http://<SERVER-IP>:5601
Protocol: HTTP (not HTTPS for Kibana)
On first login: enter enrollment token → verification code → credentials
Login with elastic and your password

11 Install Logstash

Logstash

Data processing pipeline that ingests from multiple sources, transforms it, then outputs to Elasticsearch or other sinks.

Input: Filebeat, Metricbeat, Kafka, or any logs/metrics
Processing: Filtering, parsing, enriching, and formatting
Output: Elasticsearch, Kafka, files, or other destinations

bash

apt install logstash -y

# Extract Elasticsearch CA certificate
cd /etc/elasticsearch/certs/
openssl s_client -showcerts -connect ELK-SERVER:9200 </dev/null 2>/dev/null \
| openssl x509 > /etc/logstash/elasticsearch-ca.crt

# Start service
systemctl daemon-reload
systemctl enable --now logstash
systemctl start logstash
systemctl status logstash

# Monitor logs
tail -f /var/log/logstash/logstash-plain.log

# Verify port
ss -altnp | grep 5044

Port 5044 — default port for Beats inputs (Filebeat, Metricbeat, etc.)

ELK Stack Core Components