Linux

There are several ways to install, configure and run Elasticsearch stack. This documentation provides a simple and direct approach, but the concrete configuration may differ in your environment.

On Linux based systems we recommend installing the Logstash, Elasticsearch and Kibana packages using the distribution’s package manager. Supported are the versions 7.17.x, which have been tested explicitly. Compatibility with all 7.17.x versions can be assumed. However, provided Kibana dashboards require version 7.17.x.

Elasticsearch

To install Elasticsearch, follow the instructions provided on Installation .

Elasticsearch normally uses port 9200. Please check if access to this port from outside is allowed by your firewall! In addition, how to configure authenticated access to Elasticsearch is described below.

Configuration

In addition, you can follow these steps to make your cluster fully functional. An elasticsearch.yml configuration file can contain this additional information:

xpack.monitoring.collection.enabled: true
xpack.security.authc.api_key.enabled: true
xpack.security.audit.enabled: true
# enabling security is recommended and desired
xpack.security.enabled: true
# this also comprises ssl transport security
xpack.security.transport.ssl.enabled: true
# you may define your own elasticsearch cluster name
cluster.name: <company>-operations
# each node participating in the cluster may receive an individual node name
node.name: analytics-node-01
# define network binding of elasticsearch, defaults to localhost, which is not sufficient if you distribute components across different nodes
# example here: your host is named "elastic-host.example.com"
network.host: "elastic-host.example.com"
# some settings quite specific to the number of nodes participating in your elasticsearch cluster
# if there is only a single node in your cluster, stay with the default "single-node"
# please verify w/ elastic docs: https://www.elastic.co/guide/en/elasticsearch/reference/7.17/bootstrap-checks.html
discovery.type: "single-node"
#discovery.seed_hosts: ["elastic-host.example.com"]
#cluster.initial_master_nodes: ["elastic-host.example.com"]
## Provide external paths for data and log storage
#path.data: E:/service.monitor/data/elastic
#path.logs: E:/service.monitor/logs/elastic

Enabling Transport Layer Security (TLS)

Running elasticsearch in production mode requires Transport Layer Security to be enabled. Elastic comes with some scripts to help set up this mode.

# generate new certificate authority
/usr/share/elasticsearch/bin/elasticsearch-certutil ca
# generates X.509 certificates and private keys
/usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12

Please also see the Information from Elastic on TLS .

Create default users

Elastic provides a way to autogenerate default users.

# auto create passwords for the built-in user accounts (--> xpack.security.enabled)
/usr/share/elasticsearch/bin/elasticsearch-setup-passwords auto

Logstash

To install Logstash, see the instructions .

Kibana

Configuration

A kibana.yml configuration file shall contain this additional information/configuration:

server.publicBaseUrl: "http://HOSTNAME:5601"
server.host: "HOSTNAME"
elasticsearch.hosts: ["http://HOSTNAME:9200"]
elasticsearch.username: "kibana_system"
elasticsearch.password: "******"
xpack.encryptedSavedObjects.encryptionKey: ee7b4780fc5cc492e60f365ac12788fa
xpack.reporting.encryptionKey: d4ad47d7ca8b09e650c0f0fa9baad4aa
xpack.security.encryptionKey: 3876cd060838af800da749acc9c604ff
vis_type_vega.enableExternalUrls: true

Generate encryption key

Kibana offers a command line tool to generate the keys mentioned in the example above:

\kibana\bin>kibana-encryption-keys.bat generate

To install Kibana, see the detailed instructions .