How to Install ELK Stack (Elasticsearch, Logstash and Kibana) on CentOS 7 / RHEL 7

12 Responses

  1. shashank says:

    Nice article. Thanks. But we are facing one problem. The filebeat is not sending the logs to Logstash as logs changes at client . We need to restart the filebeat every time on client to send the logs. Is there any setting which defines auto sending of Logs or time-interval at which file beat sends the logs ?

    • Hi Shashank,

      You need to edit your client’s filebeat.yml file. Update the entries whatever we discuss in document and also make sure you comment out the following lines in filebeat.yml

      ### Elasticsearch as output

      #hosts: [“localhost:9200”]

      Restart the filebeat service on client and then restart logstash service on elk server. To perform testing logout from your client and then re-login and verify the logs on Kibana, Logs should be updated for your client.

  2. Daniel Hernandez says:

    hi Pradeep,

    I found an error during creation SSL certificate with 365 days validity. please give a check I looked it for in webpages but I dont find any fix.

    thanks in advnace

    openssl req -x509 -days 365 -batch -nodes -newkey rsa:2048 -keyout logstash-forwarder.key -out logstash_frwrd.crt
    Error Loading extension section v3_ca
    139742382225312:error:2207507C:X509 V3 routines:v2i_GENERAL_NAME_ex:missing value:v3_alt.c:537:
    139742382225312:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension:v3_conf.c:93:name=subjectAltName, val ue=

    • chiefwilson says:


      I’m pretty sure you entered a typo. Recheck the openssl conf file and ensure you’ve entered the following under the [v3_ca]:

      subjectAltName = IP:

  3. suresh says:

    Unable to fetch mapping. Do you have indices matching the pattern…I couldn’t create index pattern bcoz it shows this area as transparent in the start page

  4. savi says:

    yum install filebeat
    file contain pasring errors:file:///etc/yum.repos.d/filebeat.respo

  5. vishal kumar says:

    Such a nice article. Thanks A Lot

  6. Balamurugan says:


    Files are not appearing in Kibana screen. I did all the above settings. can anyone guide me?

  7. Kagiso says:

    AWESOME! faced a few problems with filebeat config but managed to get it working, great article.

  8. Imran says:

    I am trying to install and run ELK on RHEL. I have installed with root user as it requires permissions for /etc directory but not able to run it with root user because the below error

    org.elasticsearch.bootstrap.StartupException: java.lang.RuntimeException: can not run elasticsearch as root.

    • Viswanath Reddy Y says:

      Hi Imran,

      I am trying to install the same but unfortunately I am not able to do it can you please help me out with this??

      Viswanath Reddy Y

Leave a Reply

Your email address will not be published. Required fields are marked *