ELK Installation Quick HowTo (30 minutes on Linux) - bhm-kyndryl/Metraixbeat GitHub Wiki
How to install ELK 7.10.1 on RHEL/CENTOS
Informations gathered from ELK website mainly
Build a Linux VM (RHEL or CentOS)
Will be called "elkserver.example.com" in this document
Need TCP/9200 port reachable from AIX client
Add elastic repo
sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
Import the Elasticsearch PGP Key
Create a file named "elasticsearch.repo" in the "/etc/yum.repos.d/" directory (for RedHat based distributions) containing:
[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
autorefresh=1
type=rpm-md
Install Kibana / Elasticsearch / Logstash (not mandatory) / Metrixbeat / Filebeat
sudo yum install --enablerepo=elasticsearch elasticsearch-7.10.1-1
sudo yum install --enablerepo=elasticsearch kibana-7.10.1-1
sudo yum install --enablerepo=elasticsearch logstash-7.10.1-1
sudo curl -L -O https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-7.10.1-x86_64.rpm
sudo curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.10.1-x86_64.rpm
sudo rpm -vi metricbeat-7.10.1-x86_64.rpm
sudo rpm -vi filebeat-7.10.1-x86_64.rpm
Modify "/etc/elasticsearch/elasticsearch.yml" to include the following:
network.bind_host: 0.0.0.0
node.master: true
node.data: true
transport.host: localhost
transport.tcp.port: 9300
Modify "/etc/kibana/kibana.yml" to include the following:
server.host: "elkserver.example.com"
elasticsearch.hosts: ["http://elkserver.example.com:9200"]
Modify "/etc/metricbeat/metricbeat.yml" and "/etc/filebeat/filebeat.yml" host value :
From
hosts: ["localhost:9200"]
To
hosts: ["elkserver.example.com":9200"]
Restart services to take new config into account
sudo systemctl restart elasticsearch.service
sudo systemctl restart kibana.service
sudo systemctl restart metricbeat.service
sudo systemctl restart filebeat.service (Will not send any data until configured to do so...)
sudo systemctl stop logstash.service (Stop Logstash if not used)
Upload Index templates to Elastic
sudo metricbeat setup -E 'output.elasticsearch.hosts=["elkserver.example.com:9200"]' --index-management
sudo filebeat setup -E 'output.elasticsearch.hosts=["elkserver.example.com:9200"]' --index-management
Upload Dashboard templates to Kibana
sudo metricbeat setup -E "setup.kibana.host=elkserver.example.com:5601" -E "output.elasticsearch.hosts=["elkserver.example.com:9200"]" --dashboards
sudo filebeat setup -E "setup.kibana.host=elkserver.example.com:5601" -E "output.elasticsearch.hosts=["elkserver.example.com:9200"]" --dashboards