# ELK installation and configuration

<details>

<summary>Before starting, ensure the following</summary>

* &#x20;A clean Ubuntu installation (22.04 LTS recommended).
* At least **4GB of RAM** (8GB or more preferred).
* **System Update**

```bash
sudo apt update && sudo apt upgrade -y
```

* ### **Install Java (**&#x45;lasticsearch requires Java to run. Install the **OpenJDK** package) and then Verify the installation

{% code lineNumbers="true" %}

```bash
sudo apt install openjdk-17-jdk -y
java -version
```

{% endcode %}

</details>

### <mark style="color:orange;">Installing Elasticsearch</mark>

I'll be using manually downloaded `.deb` packages.&#x20;

1. Download the `.deb` package for Elasticsearch

```bash
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.17.1-amd64.deb
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2Fh6JUlJdg0pG6bP25tuHl%2FScreenshot%20(1136).png?alt=media&#x26;token=7a86358c-a638-4fef-9336-288e2a904a1c" alt=""><figcaption></figcaption></figure>

2. Download the **SHA-512 checksum file**, which is used in the next step to verify that the Elasticsearch `.deb` package was downloaded correctly and was not corrupted or tampered with.

```bash
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.17.1-amd64.deb.sha512
```

3. Compare the SHA of the downloaded Debian package and the published checksum

```bash
shasum -a 512 -c elasticsearch-8.17.1-amd64.deb.sha512
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FPGSaJeSyl2XcANFykfXa%2FScreenshot%20(1137).png?alt=media&#x26;token=34de1727-54da-4837-9611-d7c33a600a53" alt=""><figcaption></figcaption></figure>

4. Use `dpkg` to install the package

```bash
sudo dpkg -i elasticsearch-8.17.1-amd64.deb
```

5. Edit the <kbd>elasticsearch.yaml</kbd>  , which can be accessed by

```bash
sudo nano /etc/elasticsearch/elasticsearch.yml
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FlVbpSQBc6Mcy9wPZEHY5%2FScreenshot%20(33).png?alt=media&#x26;token=bd721be9-3ef0-479a-b214-74d83f3f6994" alt=""><figcaption></figcaption></figure>

We updated the <kbd><mark style="color:green;">network.host<mark style="color:green;"></kbd> to the local IP to restrict Elasticsearch access to the local machine only, We don't need remote connections for now.

<kbd><mark style="color:green;">http.port<mark style="color:green;"></kbd>  is to set the http port for Elasticsearch to <kbd>9200</kbd>  , Which is the default.

6. Start the Elasticsearch service and Enable it to start on boot

```bash
sudo systemctl start elasticsearch
sudo systemctl enable elasticsearch
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FEIsVjIfyOwo0UhAw8SA1%2FScreenshot%20(1138).png?alt=media&#x26;token=09374713-7040-478e-b313-82d81f666065" alt=""><figcaption></figcaption></figure>

7. Check the status of the service

```bash
sudo systemctl status elasticsearch
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FgOct50vsDl3x3zEVgw4Z%2FScreenshot%20(1139).png?alt=media&#x26;token=969873e5-c705-4056-b5b3-2a9f49c9f7de" alt=""><figcaption></figcaption></figure>

8. Try accessing the Elasticsearch by  <kbd><mark style="color:blue;"><https://localhost:9200><mark style="color:blue;"></kbd>

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2F8zZCd0YJNevOJG5IiFzE%2FScreenshot%20(18).png?alt=media&#x26;token=8ce1bc2e-0931-416f-bf57-945419c8a4a7" alt=""><figcaption></figcaption></figure>

### <mark style="color:orange;">Installing Kibana</mark>

1. Do the same steps we did with Elasticsearch earlier, Download the `.deb` package for Kibana and the SHA512, After the comparison, we can install the package&#x20;

```bash
wget https://artifacts.elastic.co/downloads/kibana/kibana-8.17.1-amd64.deb
wget https://artifacts.elastic.co/downloads/kibana/kibana-8.17.1-amd64.deb.sha512
shasum -a 512 kibana-8.17.1-amd64.deb 
sudo dpkg -i kibana-8.17.1-amd64.deb
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FQzRU9CJmt8yDK7Ab6CQw%2FScreenshot%20(1146).png?alt=media&#x26;token=a28e0d9a-0a77-4c7c-ad81-62399d1313ad" alt=""><figcaption></figcaption></figure>

2. Edit the <kbd>kibana.yaml</kbd> file&#x20;

```bash
sudo nano /etc/kibana/kibana.yml
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FCErWJZkpkJwlkhbjzT0h%2FScreenshot%20(30).png?alt=media&#x26;token=19204844-5830-4b99-bcc5-0e6f533425a5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FXWLCyGdE48BYqcnpDTeP%2FScreenshot%20(31).png?alt=media&#x26;token=54a1bf3c-8f9e-41df-b6ec-7986c3f1ca10" alt=""><figcaption></figcaption></figure>

<kbd><mark style="color:green;">server.port: 5601<mark style="color:green;"></kbd> This confirms Kibana will run on port 5601, which is the default.

<kbd><mark style="color:green;">server.host: "localhost"<mark style="color:green;"></kbd> This ensures Kibana is only accessible from the localhost, meaning it cannot be accessed remotely. If you want to allow remote access to Kibana, you can change it to 0.0.0.0 or any specific IP address.

<kbd><mark style="color:green;">elasticsearch.hosts: \["<http://localhost:9200>"]<mark style="color:green;"></kbd> This tells Kibana where to find Elasticsearch. In this case, Kibana will connect to an Elasticsearch instance running on the same machine.

3. Start the Kibana service and Enable it to start on boot

```bash
sudo systemctl start kibana
sudo systemctl enable kibana
sudo systemctl status kibana
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2F0iqLGHKhcGZ5nhyGQW1T%2FScreenshot%20(1147).png?alt=media&#x26;token=d02dec8d-7239-401c-80eb-259622e15839" alt=""><figcaption></figcaption></figure>

4. Try accessing the kibana by <kbd><mark style="color:blue;">http:\\\localhost:5601<mark style="color:blue;"></kbd>

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2Fy0yHL5dpBOOSztj2m90k%2FScreenshot%20(19).png?alt=media&#x26;token=25714307-2da0-40c5-87ba-0e9a82509a52" alt=""><figcaption></figcaption></figure>

5. To create the enrollment token:

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FVEEyw2icz2jMip38WADO%2FScreenshot%20(20).png?alt=media&#x26;token=0de7da6a-01ba-4cb8-89ca-a79735604467" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FHTdrbiAjliVOf13Q0KJj%2FScreenshot%20(21).png?alt=media&#x26;token=b1ae709c-2864-4c02-b48b-297b9490816f" alt=""><figcaption></figcaption></figure>

6. The verification code will then be requested, which we can obtain by:

```bash
sudo journalctl -u kibana --no-pager | grep "verification code"
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2Fvwfjhv3UzVqHNj1gplkt%2FScreenshot%20(23).png?alt=media&#x26;token=6738ec24-4af8-4362-96a1-0a40b7eeb3a4" alt=""><figcaption></figcaption></figure>

7. The login page will appear, and we will reset the password of the default user (elastic):

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic
```

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2F2C7IxySJ6DPl044JoXCH%2FScreenshot%20(28).png?alt=media&#x26;token=fd0263f6-c6b0-423e-bbdd-b03aa166d63b" alt=""><figcaption></figcaption></figure>

8. Finally, we are in!&#x20;

<figure><img src="https://1813390017-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXKIbWIkmUUOy5JNBeX24%2Fuploads%2FXqgsTCw5e6WP77O9d7Vi%2FScreenshot%20(29).png?alt=media&#x26;token=859c5c32-7800-4d58-952d-7a8aba0a986d" alt=""><figcaption></figcaption></figure>
