Use a machine with at least 4GiB of RAM. This guide will install
ElasticSearch, Logstash and Kibana all on the same machine, so this is
suited only for a small-scale setup.
Warning: ELK is under contant development, and this guide is
probably out of date now…
Install and configure ElasticSearch
/etc/elasticsearch/elasticsearch.yml and do the following:
node.name to something descriptive
cluster.name to something unique to avoid issues with
network.host to “localhost”
path.logs if necessary
/etc/elasticsearch/jvm.options and set the heap size according
to your machine RAM, for example (to set it to 2GiB):
Probably the easiest is to divide the available RAM by 4 and take that
figure for each service (ElasticSearch, Logstash and Kibana, with the
rest for the OS).
A setting of 1GiB is probably the minimum you should use.
Make sure you disable swapping!
Install and configure Kibana
$ sudo apt install kibana. Then edit
server.host to “localhost”. Then:
Create a DNS entry for your kibana host and an SSL certificate.
Install nginx as reverse proxy with authentication:
Then edit an nginx site file (eg:
and make it look like this:
Activate the site like so:
Install and configure logstash
$ sudo apt install logstash. Edit
/etc/logstash/jvm.options and set the heap size according to your
machine RAM, for example (to set it to 2GiB):
A setting of 1GiB is probably the minimum you should use. Create a
/etc/logstash/conf.d/GIVE_ME_A_NAME.conf and edit it so it
looks like this:
NB: The grok patterns assume the following log formats for apache:
NB: You can use this to test your
Install and configure filebeat
Filebeat goes on the machine where your service is running, not the
To install filebeat:
/etc/filebeat/filebeat.yml so it looks like this:
You should have a working system now.