Installing the Elastic Stack
Installing Elasticsearch
Josh Stroschein
Security Researcher
@jstrosch www.0xevilc0de.com
Discuss the challenges of enterprise-wide logging
and how to solve with the Elastic Stack
Install and configure the key components of Elastic:
- Elasticsearch
Overview
- Logstash
- Kibana
- Beats
Take monitoring from non-existent to fully-
fledged, enterprise ready
Create informative visualizations and
dashboards
Implement proactive monitoring with alerting
capabilities
Why Use Elasticsearch
Very scalable and distributed search and analytics platform
Comes with search, aggregation and sharding capabilities
Used by many companies, from start-ups to top global companies
such as Netflix and Microsoft
Provides you with the ability to log, index and search massive
amounts of data
What Is the Elastic Stack?
Also known as the ELK Stack
Elasticsearch
- Provides a distributed, JavaScript Object
Notation (JSON)-based search and
analytics engine
Logstash
- Data processing pipeline to move and
transform
Kibana
- An extensible user interface
Beats
- Data shippers
Your Role Today
United States
Europe
GLOBOMANTICS
DevOps / IT / Security
Asia
Collecting Data
Memory & CPU
Applications
Storage
Email & Database
Applications
Building with Beats
Beats Logstash Elasticsearch Kibana
Filebeat
Packetbeat
Metricbeat
Winlogbeat
Infrastructure Build-out
Start from the back and work our way forward!
Elasticsearch clusters are often made up of many nodes
For this course, our cluster will contain only a single node
Will be utilizing both Windows and Linux servers
More great content on Pluralsight that covers administering an
Elastic cluster
Data center
Install Elasticsearch on Linux
Demo – Ubuntu 20.04 LTS
Installation will be completed through
distribution packages
– Utilize Ubuntu Linux for the course
Ensure adequate configuration changes
Verify everything is working correctly
Walk-through installation in Windows
Demo Server
Review necessary requirements
Utilize official Elastic Windows archive
– Note, there is an MSI installer
available
Verify everything is working correctly
