ELK Installation Guide

Installing ELK Stack (ElasticSearch, Logstash, Kibana) with Docker

It is recommended to install on Docker due to lower resource consumption. The installation version used below is 8.12.2. Please use the same version to avoid conflicts.

Table of Contents

1. Install ElasticSearch
2. Install Logstash
3. Install Kibana
Recommendations

---

1. Install ElasticSearch

• Pull the image:

docker pull elasticsearch:8.12.2
````

* Start the container:

```bash
docker run --name some-elasticsearch -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -d elasticsearch:8.12.2

• Enter the container:

sudo docker exec -u 0 -it some-elasticsearch bash

• Restart the container:

docker restart some-elasticsearch

---

2. Install Logstash

• Pull the image:

docker pull docker.elastic.co/logstash/logstash:8.12.2

• Start the container:

sudo docker run -it -p 5044:5044 -p 9600:9600 --name logstash -v /usr/share/logstash/piplines:/usr/share/logstash/config --privileged=true docker.elastic.co/logstash/logstash:8.12.2 /bin/bash

• Use scp to upload the MySQL Connector JAR file to the virtual machine:

scp "/Users/Downloads/logstash-8.12.2/mysql-connector-j-8.4.0.jar" username@VM-IP:/home

• Move the JAR file from the VM to the Logstash container:

docker cp ./mysql-connector-j-8.4.0.jar logstash:/usr/share/logstash

• Enter the container:

docker exec -u 0 -it logstash bash

---

3. Install Kibana

• Pull the image:

docker pull kibana:8.12.2

• Start the container:

docker run --name some-kibana -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" -d elasticsearch:8.12.2

• Enter the container:

docker exec -u 0 -it some-kibana bash

---

Additional: Install Docker, Portainer, and Related Commands

sudo apt update
sudo apt install docker.io docker-compose
docker -v
sudo systemctl start docker

sudo docker search portainer
docker pull portainer/portainer
sudo docker pull portainer/portainer
sudo docker run -d --name portainerUI -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock portainer/portainer

sudo docker start portainerUI
sudo passwd root

---