How to Set Up ELK Stack for Server Log Management

The ELK Stack aggregates logs from multiple servers into searchable, visualisable dashboards.

Step 1 — Install Elasticsearch

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
sudo apt update && sudo apt install elasticsearch kibana logstash -y

Step 2 — Configure Logstash

input { beats { port => 5044 } }
filter { grok { match => { "message" => "%{NGINXACCESS}" } } }
output { elasticsearch { hosts => ["localhost:9200"] index => "nginx-logs-%{+YYYY.MM.dd}" } }

Step 3 — Install Filebeat on Servers

sudo apt install filebeat -y
sudo filebeat modules enable nginx
sudo systemctl enable filebeat --now

Conclusion

ELK Stack provides enterprise log management. Our team deploys ELK Stack for centralised log analysis.