Elastic Stack (cluster)

Deploy Elastic Stack, a unified observability platform for collecting, indexing, searching, and visualizing logs and operational data. It combines Elasticsearch, Logstash, and Kibana to ingest, analyze, and visualize operational data for monitoring, troubleshooting, and security analysis.

The app deploys a multi-node Elastic Stack cluster using an automated deployment script configured by Akamai.

1. Deploy Elastic Stack

 Estimated deployment time: 5–10 minutes for a cluster of 5 nodes.
 Larger clusters may take longer to provision.

Base distribution

• Supported distribution: Ubuntu 24.04 LTS

Configuration options

StackScript ID: 1966222

Notes:

• After the app deployment completes, the password for your limited sudo user is generated and stored in the .credentials file in the home directory, along with application-specific passwords. Log in to your instance as root through the Lish console or SSH, then run cat /home/$USERNAME/.credentials to view its contents.
• You can automatically configure a custom domain (optional) during deployment. To do that:
  1. First, configure your domain to use Linode’s name servers via your registrar. See Configure your domain's authoritative name servers for details.
  2. Once you complete that, specify the Linode API token, subdomain, and domain for the app in Cloud Manager or via API/CLI/Terraform.

Use API, CLI, or Terraform

curl --location 'https://api.linode.com/v4/linode/instances' \
    --header 'Content-Type: application/json' \
    --header 'Accept: application/json' \
    --header 'Authorization: Bearer abc123def456hij789klm' \
    --data-raw '{
        "region": "us-east",
        "type": "g6-standard-2",
        "image": "linode/ubuntu24.04",
        "label": "my-elastic-search-cluster-one-click-app",
        "root_pass": "@C0mpl3x#P@ssw0rd",
        "stackscript_id": 1966222,
        "stackscript_data": {
            "token_password": "abc123def456hij789klm",
            "soa_email_address": "jsmith@example.com",
            "user_name": "jsmith",
            "country_name": "US",
            "state_or_province_name": "Massachusetts",
            "locality_name": "Cambridge",
            "organization_name": "Akamai Technologies",
            "email_address": "jsmith-other@example.com",
            "ca_common_name": "Elasticsearch CA"
        }
    }'

linode-cli linodes create \
    --region us-east \
    --type g6-standard-2 \
    --label my-elastic-search-cluster-one-click-app \
    --image linode/ubuntu24.04 \
    --root_pass @C0mpl3x#P@ssw0rd \
    --stackscript_id 1966222 \
    --stackscript_data '{"token_password": "abc123def456hij789klm", "soa_email_address": "jsmith@example.com", "user_name": "jsmith", "country_name": "US", "state_or_province_name": "Massachusetts", "locality_name": "Cambridge", "organization_name": "Akamai Technologies", "email_address": "jsmith-other@example.com", "ca_common_name": "Elasticsearch CA"}'

resource "linode_instance" "my-linode" {
    region         = "us-east"
    type           = "g6-standard-2"
    label          = "my-elastic-search-cluster-one-click-app"
    image          = "linode/ubuntu24.04"
    root_pass      = "@C0mpl3x#P@ssw0rd"
    stackscript_id = 1966222
    stackscript_data = {
        "token_password"         = "abc123def456hij789klm"
        "soa_email_address"      = "jsmith@example.com"
        "user_name"              = "jsmith"
        "country_name"           = "US"
        "state_or_province_name" = "Massachusetts"
        "locality_name"          = "Cambridge"
        "organization_name"      = "Akamai Technologies"
        "email_address"          = "jsmith-other@example.com"
        "ca_common_name"         = "Elasticsearch CA"
    }
}

2. Access Elastic Stack

Once the Elastic Stack cluster is deployed, log in to it using your browser.

1. Log in to the provisioner node as your limited sudo user by running ssh USER@IP_ADDRESS. Replace USER with the sudo username you created, and IP_ADDRESS with the instance’s IPv4 address.

   Note: Your provisioner node is the first Linode created in your cluster and is also the instance running Kibana. To identify the node in your list of Linodes, look for the node appended with the name kibana. For example, kibana-1a2bc34d5.

2. Open the .credentials file with the sudo cat /home/USER/.credentials command. Replace USER with your sudo username.

3. In the .credentials file, locate the Kibana URL. After pasting the URL into your browser, you're redirected to the Elastic login page.

4. Provide elastic as the username along with the password retrieved from the .credentials file.

   A successful login redirects you to the homepage. From there, you can add integrations, visualizations, and make other configuration changes.

Configure Filebeat (optional)

If you already have Filebeat on your system, follow these steps to configure it:

1. Create a backup of your /etc/filebeat/filebeat.yml configuration.

   Bash

   cp /etc/filebeat/filebeat.yml{,.bak}

2. Update your Filebeat inputs.

   File: /etc/filebeat/filebeat.yml

   filebeat.inputs:
   
   # Each - is an input. Most options can be set at the input level, so
   # you can use different inputs for various configurations.
   # Below are the input-specific configurations.
   
   # filestream is an input for collecting log messages from files.
   - type: filestream
   
       # Unique ID among all inputs, an ID is required.
       id: web-01
   
       # Change to true to enable this input configuration.
       #enabled: false
       enabled: true
   
       # Paths that should be crawled and fetched. Glob based paths.
       paths:
           - /var/log/apache2/access.log

   In this example, the id must be unique to the instance so you know the source of the log. Ideally, this should be the instance’s hostname. This example uses the value web-01. Update paths to the log that you want to send to Logstash.

3. While in /etc/filebeat/filebeat.yml, update the Filebeat output directive.

   File: /etc/filebeat/filebeat.yml

   output.logstash:
       # Logstash hosts
       hosts: ["logstash-1.example.com:5044", "logstash-2.example.com:5044"]
       loadbalance: true
   
       # List of root certificates for HTTPS server verifications
       ssl.certificate_authorities: ["/etc/filebeat/certs/ca.pem"]

   The hosts param can be the IP addresses of your Logstash host or an FQDN. In this example, logstash-1.example.com and logstash-2.example.com are added to the /etc/hosts file.

4. Add a Certificate Authority (CA) certificate by adding the contents of ca.crt to your /etc/filebeat/certs/ca.pem file.

   To get your ca.crt, open a separate terminal session and log in to your Kibana node. Navigate to the /etc/kibana/certs/ca directory, and view the file contents with the cat command.

   Bash

   cd /etc/kibana/certs/ca
   sudo cat ca.crt

5. Copy the file contents and add it to your ca.pem file on your Filebeat system.

6. Restart the Filebeat service.

   Bash

   systemctl start filebeat
   systemctl enable filebeat

   Once complete, you should be able to start ingesting logs into your cluster using the index you created.

Additional resources

For more information about the installed packages, see their official documentation.

• Elastic Stack Documentation