Getting started with the Elastic Stack

Looking for a guide that shows how to quickly install and configure the Elastic Stack ("ELK")? You’re in the right place! You can install the Elastic Stack on a single VM, or even on your laptop. Install each component in the following order:

After completing the installation process, learn how to implement a system monitoring solution that uses Metricbeat to collect server metrics and ship the data to Elasticsearch. Then use Kibana to search and visualize the data.

Elasticsearch is a real-time, distributed storage, search, and analytics engine. It can be used for many purposes, but one context where it excels is indexing streams of semi-structured data, such as logs or decoded network packets.

To download and install Elasticsearch, open a terminal window and use the commands that work with your system:

When you start Elasticsearch for the first time, security features such as authentication, authorization and network encryption (TLS) for elasticsearch are enabled by default. The following security configuration occurs automatically:

You can then start Kibana and enter the enrollment token to securely connect Kibana with Elasticsearch. The enrollment token is valid for 30 minutes.

deb:

curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.0.1-amd64.deb
sudo dpkg -i elasticsearch-8.0.1-amd64.deb
sudo /etc/init.d/elasticsearch start

rpm:

curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.0.1-x86_64.rpm
sudo rpm -i elasticsearch-8.0.1-x86_64.rpm
sudo service elasticsearch start

mac:

curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.0.1-darwin-x86_64.tar.gz
tar -xzvf elasticsearch-8.0.1-darwin-x86_64.tar.gz
cd elasticsearch-8.0.1
./bin/elasticsearch

linux:

curl -L -O https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.0.1-linux-x86_64.tar.gz
tar -xzvf elasticsearch-8.0.1-linux-x86_64.tar.gz
cd elasticsearch-8.0.1
./bin/elasticsearch

win:

For other operating systems, go to the Elasticsearch download page.

To learn more about installing, configuring, and running Elasticsearch, read the Elasticsearch Reference.

Open a new terminal and verify that you can connect to your Elasticsearch cluster by making an authenticated call. Enter the password for the elastic user when prompted:

curl --cacert $ES_PATH_CONF/certs/http_ca.crt -u elastic https://localhost:9200

On Windows, if you don’t have cURL installed, point your browser to the URL.

You should see a response similar to this:

{
  "name" : "QtI5dUu",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "v8OWkR1OQO-rgV8o_lRhEA",
  "version" : {
    "number" : "8.0.1",
    "build_flavor" : "default",
    "build_type" : "tar",
    "build_hash" : "f4d76bd413ecfbd5122c3aa5dc85465960f18afe",
    "build_date" : "2021-10-27T22:47:53.634020433Z",
    "build_snapshot" : false,
    "lucene_version" : "9.0.0",
    "minimum_wire_compatibility_version" : "7.16.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

Kibana is an open source analytics and visualization platform designed to work with Elasticsearch. You use Kibana to search, view, and interact with data stored in Elasticsearch indices. You can easily perform advanced data analysis and visualize your data in a variety of charts, tables, and maps.

We recommend that you install Kibana on the same server as Elasticsearch, but it’s not required. If you install the products on different servers, you’ll need to change the URL (IP:PORT) of the Elasticsearch server in the Kibana configuration file, kibana.yml, before starting Kibana.

To download and install Kibana, open a terminal window and use the commands that work with your system:

If this is the first time you’re starting Kibana, this command generates a unique link in your terminal to enroll your Kibana instance with Elasticsearch.

deb, rpm, or linux:

curl -L -O https://artifacts.elastic.co/downloads/kibana/kibana-8.0.1-linux-x86_64.tar.gz
tar xzvf kibana-8.0.1-linux-x86_64.tar.gz
cd kibana-8.0.1-linux-x86_64/
./bin/kibana

mac:

curl -L -O https://artifacts.elastic.co/downloads/kibana/kibana-8.0.1-darwin-x86_64.tar.gz
tar xzvf kibana-8.0.1-darwin-x86_64.tar.gz
cd kibana-8.0.1-darwin-x86_64/
./bin/kibana

win:

For other operating systems, go to the Kibana download page.

To learn more about installing, configuring, and running Kibana, read the Kibana Reference.

To access the Kibana web interface, point your browser to port 5601. For example, http://127.0.0.1:5601.

The Beats are open source data shippers that you install as agents on your servers to send operational data to Elasticsearch. Beats can send data directly to Elasticsearch or via Logstash, where you can further process and enhance the data.

Each Beat is a separately installable product. In this guide, you learn how to install and run Metricbeat with the system module enabled to collect system metrics.

To learn more about installing and configuring other Beats, see the Getting Started documentation:

To download and install Metricbeat, open a terminal window and use the commands that work with your system:

deb:

curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-8.0.1-amd64.deb
sudo dpkg -i metricbeat-8.0.1-amd64.deb

rpm:

curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-8.0.1-x86_64.rpm
sudo rpm -vi metricbeat-8.0.1-x86_64.rpm

mac:

curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-8.0.1-darwin-x86_64.tar.gz
tar xzvf metricbeat-8.0.1-darwin-x86_64.tar.gz

linux:

curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-8.0.1-linux-x86_64.tar.gz
tar xzvf metricbeat-8.0.1-linux-x86_64.tar.gz

win:

For other operating systems, go to the Beats download page.

Metricbeat provides pre-built modules that you can use to rapidly implement and deploy a system monitoring solution, complete with sample dashboards and data visualizations, in about 5 minutes.

In this section, you learn how to run the system module to collect metrics from the operating system and services running on your server. The system module collects system-level metrics, such as CPU usage, memory, file system, disk IO, and network IO statistics, as well as statistics for every process running on your system.

Before you begin: Verify that Elasticsearch and Kibana are running and that Elasticsearch is ready to receive data from Metricbeat.

To set up the system module and start collecting system metrics:

Metricbeat runs and starts sending system metrics to Elasticsearch.

To visualize system metrics, open your browser and navigate to the Metricbeat system overview dashboard: http://localhost:5601/app/kibana#/dashboard/Metricbeat-system-overview-ecs

Click Host Overview to see detailed metrics about the selected host.

Congratulations! You’ve successfully set up the Elastic Stack and securely connected Kibana with Elasticsearch. You learned how to stream system metrics to Elasticsearch and visualize the data in Kibana.

Next, you’ll want to activate your trial license to unlock the full capabilities of the Elastic Stack.

Want to get up and running quickly with metrics monitoring and centralized log analytics? Try out the Metrics app and the Logs app in Kibana. For more details, see Analyze metrics and Monitor logs.

Later, when you’re ready to set up a production environment, also see the Elastic Stack Installation and Upgrade Guide.