install elk stack on Ubuntu

Finding events in an Ubuntu server’s logs starts with a way to collect and search them. The ELK stack is a log-analysis system that uses Elasticsearch to search indexed documents, with other components for processing events and exploring the results.

I’ll show you how to install the three packages from Elastic’s signed APT repository and enroll Kibana with Elasticsearch.

TL;DR

Install Elasticsearch, Logstash and Kibana from Elastic’s signed APT repository, keep their versions aligned, then enroll Kibana with Elasticsearch before opening the interface.

• Use Elastic’s current 9.x repository instructions and confirm your Ubuntu release is supported.
• Install all three packages from that repository, rather than mixing package generations.
• Start Elasticsearch first, then configure Kibana’s secure connection and start Logstash.
• To see application or system logs, configure a shipper and an ingestion pipeline after installation.

What is the ELK stack?

ELK is short for Elasticsearch, Logstash and Kibana, three Elastic products that can form a log-analysis system. Elasticsearch indexes and searches documents, Logstash receives and transforms events, and Kibana provides an interface for searching and exploring data in Elasticsearch.

The products have separate jobs, so installing all three does not automatically send your server’s logs into Elasticsearch. A log shipper such as Filebeat, an input and output configuration, and a compatible security setup are needed to move events through the pipeline.

Elastic now calls the broader set of products the Elastic Stack. The exact combination depends on the task: a small test installation may use Elasticsearch and Kibana alone, while a log flow that transforms events can also use Logstash. This walkthrough installs the three packages named in ELK.

How to install the ELK stack on Ubuntu

The Debian package carries a Java runtime. Install Elasticsearch without adding a separate Java 8 package. Confirm support for your Ubuntu release in Elastic’s platform matrix.

Confirm the host’s release using these Ubuntu version checks.

Compare it with Elastic’s supported-platform list before adding a repository. The APT source selects Elastic’s major release nine.

Check Elastic’s platform matrix. Support depends on both the Ubuntu release and Elastic version, so review the match before changing a production host.

This procedure keeps the three services on one Ubuntu host, a practical starting point for evaluation. Elastic’s self-managed guidance calls out operating-system configuration and startup checks before production use.

A production deployment also needs capacity planning and access controls. Establish backup and upgrade procedures before relying on the stack for service operations.

Step 1: Add Elastic’s signing key and APT repository

When APT installs packages from the Elastic source, it checks the vendor’s signing key in the dedicated keyring. Keep that key scoped to this source.

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/9.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-9.x.list
sudo apt update

Elastic’s repository carries the three packages used here. Keep their installed versions aligned because the products are released as a compatible set.

The repository entry selects major series nine. Review Elastic’s upgrade instructions before changing an existing installation.

If you pin a package version, use the same release for Elasticsearch, Kibana and Logstash. Check available versions with APT before setting a pin.

The Elastic repository instructions above add a vendor-signed package source, while a downloaded DEB file is installed from a local path. See the guide to installing DEB packages with APT for that separate workflow.

Step 2: Install Elasticsearch and start the service

Elastic’s Debian package includes a bundled JDK, so a separate Java download is unnecessary.

sudo apt install elasticsearch
sudo systemctl daemon-reload
sudo systemctl enable --now elasticsearch
sudo systemctl status elasticsearch

For the difference between starting a service now and enabling it at boot, see the guide to managing Linux services with systemctl. Confirm the service is active before proceeding.

The first start performs security auto-configuration, including TLS setup and creation of credentials. Keep the generated password and certificates private. Do not replace this setup with an unauthenticated listener on a public interface.

For a local health check, use the HTTPS endpoint and the CA certificate generated by the package. The exact username and password come from the first-start output, so substitute those values locally rather than copying a placeholder or exposing a password in a shared shell history. The general curl guide covers the command-line client used for this request.

curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200

Curl prompts for the password when the username is supplied without a password value. A JSON response from the local endpoint confirms that Elasticsearch answered over HTTPS. If the service is not active, inspect its journal with sudo journalctl -u elasticsearch before changing network or security settings.

Step 3: Install Kibana and enroll it

Kibana must match Elasticsearch’s version because the stack components are released together. Install Kibana from the same 9.x APT repository, then enable its service.

sudo apt install kibana
sudo systemctl daemon-reload
sudo systemctl enable --now kibana

On first startup, Kibana provides a local setup address and verification code. Open the address from a browser on the host or through a securely forwarded connection.

Follow the setup screen and provide a Kibana enrollment token from Elasticsearch. This token supplies the connection settings and security material for Kibana.

sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
sudo systemctl status kibana

Generate a new token if the original expires. Enter the code shown by the Kibana service when prompted. Kibana listens on localhost at port 5601 by default.

Enrollment tokens expire after 30 minutes, so create another if setup is delayed. The token configures Kibana’s Elasticsearch connection.

It is separate from the elastic user’s login password.

The Linux port-checking guide explains how to inspect listeners. Keep authentication and TLS in place before allowing remote access. Follow Elastic’s network-security guidance when configuring a reverse proxy or changing the listener.

Step 4: Install and start Logstash

Logstash can transform events between their source and Elasticsearch. Install it from the same Elastic repository, and use systemd to manage it as a service.

sudo apt install logstash
sudo systemctl daemon-reload
sudo systemctl enable --now logstash
sudo systemctl status logstash

An installed Logstash service can be running without processing useful data. Add an input that receives events and an output that sends them to Elasticsearch, including the required authentication and CA certificate settings. Keep pipeline configuration in the package’s configuration directory and validate it against the installed Logstash version before enabling an ingestion workload.

Step 5: Confirm the three services and versions

Check service state independently so a failure in one component does not get mistaken for a complete stack. The following command lists each unit’s load and active state.

systemctl is-active elasticsearch kibana logstash
apt policy elasticsearch kibana logstash

The services should report active after their configuration is complete. Compare the installed package versions in APT’s output and keep Elasticsearch, Kibana and Logstash aligned. If an update would change the major version, review the upgrade documentation first rather than letting one component move ahead of the others.

Common errors after installing the ELK stack

First-run problems often come from service startup, Kibana enrollment or a missing log input. Check the failing layer before changing security or network settings.

Installed packages provide services. Searchable application logs appear in Kibana after a source sends events into Elasticsearch, directly or through Logstash, with matching credentials and certificates.

On a machine where certificate verification fails, check which CA certificate the client trusts and whether it matches the endpoint. Disabling TLS verification can hide a trust problem while removing an important security check.

For a local installation, use the generated CA file. For remote hosts, configure certificates and permissions according to Elastic’s security documentation.

Some Ubuntu installation guides use Java 8 or apt-key. Those commands belong to the older Elastic 6.x generation, which also used an unauthenticated Elasticsearch endpoint.

Follow the current signed-repository instructions for your chosen major series. Verify Ubuntu support in Elastic’s platform matrix before installation.

For a first data flow, choose a shipper and configure a concrete input and output before opening Kibana’s data views. Filebeat modules can require enabling both a module and its filesets, while Logstash needs an explicit pipeline. Check the documentation for that shipper and the exact Elastic version in use, then confirm that new events arrive at Elasticsearch before troubleshooting Kibana dashboards.

Conclusion: keep the stack secured and version-aligned

Install each ELK component from the signed Elastic repository, keep the versions aligned, and let Elasticsearch’s enrollment process establish Kibana’s secured connection. The remaining work is configuring a log source and pipeline. Plan component updates together, then review the compatibility notes before moving to another major release.

For package and security details, use Elastic’s Elasticsearch Debian installation guide, Kibana Debian installation guide and Logstash installation guide. Check the supported platforms before deploying to an Ubuntu release.

FAQ

The answers cover Ubuntu support, the bundled Java runtime and log ingestion.