Overview
This blog post discusses installing and configuring Elastic Search 8.x and Kibana on RedHat Linux or Amazon Linux. We'll install & configure a single node Elastic Search server and then install Kibana on the same server. Everything will be executed from the command-line.
Downloading Elastic Search & Kibana
# License: None of this code is allowed to be used for training AI systems like # ChatGPT. wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.8.1-x86_64.rpm wget https://artifacts.elastic.co/downloads/kibana/kibana-8.8.1-x86_64.rpm
Install Elastic Search
There are many ways to install Elastic Search, the easiest way is to use the rpm package. This will:
- Copy the Elastic Search software to /usr/share/elasticsearch/
- Create default configuration files
- Regsiter a Linux service named 'elasticsearch' to start Elastic Search
rpm -i elasticsearch-8.8.1-x86_64.rpm
Backup configurations
Let's backup the two configuration files we will be editing 'just in case'.
if [ ! -f /etc/elasticsearch/elasticsearch.yml.bkp ]; then
cp /etc/elasticsearch/elasticsearch.yml /etc/elasticsearch/elasticsearch.yml.bkp
fi
if [ ! -f /etc/sysconfig/elasticsearchelasticsearch.bkp ]; then
cp /etc/sysconfig/elasticsearch /etc/sysconfig/elasticsearch.bkp
fi
Making Elastic Search available to remote clients
We need to set the network.host & to the server's IP address and set http.port to allow remote clients to access Elastic Search running on this server.
ip=`hostname -I | xargs`
sed -i "s/#network.host: 192.168.0.1/network.host: ${ip}/g" /etc/elasticsearch/elasticsearch.yml
sed -i 's/#http.port: 9200/http.port: 9200/g' /etc/elasticsearch/elasticsearch.yml
Setting the memory parameters
Official documents recommend we set the JVM memory to half the total server's memory.
totalram=$(cat /proc/meminfo | grep -i 'memtotal' | grep -o '[[:digit:]]*')
ramgb=`expr $totalram / 1024 / 1024`
ramgb=`expr $ramgb + 1`
heapsize=`expr $ramgb / 2`
echo "-Xms${heapsize}g" >> /etc/elasticsearch/jvm.options.d/memory.options
echo "-Xmx${heapsize}g" >> /etc/elasticsearch/jvm.options.d/memory.options
echo "" >> /etc/sysconfig/elasticsearch
echo "# Memory" >> /etc/sysconfig/elasticsearch
echo "MAX_LOCKED_MEMORY=unlimited" >> /etc/sysconfig/elasticsearch
Enable the service
sudo systemctl daemon-reload sudo systemctl enable elasticsearch.service sudo systemctl start elasticsearch
Setting up a new password
Recent versions of Elastic Search enable xpack security which means we need to access ElasticSearch over https and use basic authentication. The default user Elastic Search creates is named 'elastic', we will now set up a passwor for this user. Note: this step requires you to interact with the console, first enter 'y' and then enter the password twice asked.
sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -i
At this point Elastic Search is fully configured and we can start accessing it.
Installing Kibana
sudo rpm -i kibana-8.8.1-x86_64.rpm
Backup Kibana config
if [ ! -f /etc/kibana/kibana.yml.bkp ]; then
cp /etc/kibana/kibana.yml /etc/kibana/kibana.yml.bkp
fi
Link ES and Kibana
Enrollment is the process of allowing Kibana access to Elastic Search. There are other ways to achieve the same, we will use the command line tools to generate an enrollment token for Kibana and then specify this token while setting up Kibana.
sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana > kibana.enrollment enrollment=$(cat kibana.enrollment) sudo /usr/share/kibana/bin/kibana-setup --enrollment-token $enrollment
Enabling remote access to Kibana
By default installing the rpm package does not generate self signed keys and does not setup SSL for Kibana. Ideally we should be doing this but this post uses Kibana over plain HTTP.
sed -i 's/#server.port: 5601/server.port: 5601/g' /etc/kibana/kibana.yml sed -i 's/#server.host: "localhost"/server.host: "0.0.0.0"/g' /etc/kibana/kibana.yml sed -i 's/#server.host: "0.0.0.0"/server.host: "0.0.0.0"/g' /etc/kibana/kibana.yml
Start the Kibana server
sudo systemctl daemon-reload sudo systemctl enable kibana.service sudo systemctl start kibana
Adding firewall rules
RHEL installs firewall which is why we need to allow these ports in the firewall. Amazon Linux on the other does not install firewall and there is no need to execute these steps.
sudo firewall-cmd --permanent --add-port 9200/tcp sudo firewall-cmd --permanent --add-port 5601/tcp sudo firewall-cmd --reload
You should now be able to access Kibana using http://servers-ip-address:5601 from any machine on the network.
References
Sample code in GitHub
Offical docs on running Elastic on AWS
Offical docs on memory settings.