# Configure Elasticsearch and Kibana setup in ubuntu

Elasticsearch components are not included in Ubuntu's default package repositories. However, they can be installed via APT by adding Elastic’s official package source. To ensure security and prevent package spoofing, all packages are signed with a GPG key, allowing the package manager to verify their authenticity. To proceed with the installation, let's import the public GPG key and add the Elastic package source list.

```bash
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FQDgQGtLTYBwGx9dSBNoZ%2Fphoto_5839181504507398378_y.jpg?alt=media&#x26;token=6fb1df81-341f-4998-b35c-91348a653e94" alt=""><figcaption></figcaption></figure>

* [https://artifacts.elastic.co/GPG-KEY-elasticsearch](https://artifacts.elastic.co/GPG-KEY-elasticsearch): Elasticsearch’s public **GPG key**, a cryptographic "signature" used to verify the authenticity of packages.
* **`--dearmor`**: Converts the GPG key from human-readable text to **binary format** because Debian’s `apt` expects keys in binary format for verification.

Next, let's add Elasticsearch Repository to APT Sources:

```bash
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FVS1yosP3Yqkk2yeluUwv%2FScreenshot(9).png?alt=media&#x26;token=ba894c98-ec65-48e4-9e69-d27f05798e11" alt=""><figcaption></figcaption></figure>

* Here I'm telling `apt` where to find Elasticsearch packages ([https://artifacts.elastic.co/packages/8.x/apt](https://artifacts.elastic.co/packages/8.x/apt\).)).
* The `[signed-by=...]` option ensures packages from this repository are verified using the GPG key.

Next, let's update our APT packages index with the new Elastic source:

```bash
sudo apt-get update
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FR4dZFaliyw2Mc4LcPtSZ%2FScreenshot(10).png?alt=media&#x26;token=7a35584f-e344-4d99-8c00-44eb3c8c038a" alt=""><figcaption></figcaption></figure>

Next, let's install the Elasticsearch Debian package.

```bash
sudo apt-get install elasticsearch
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FZFLidqqat8GFr9xLjA9d%2FScreenshot(12).png?alt=media&#x26;token=19cd8d9a-7660-4fd8-9f0e-4e28236f09d1" alt=""><figcaption></figcaption></figure>

Next, we need to update the elasticsearch.yml with following network host and port configurations.

```bash
sudo nano /etc/elasticsearch/elasticsearch.yml
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Flv1mszLCE9ifIOA640q4%2FScreenshot(15).png?alt=media&#x26;token=9c89f7bf-5332-4420-9771-711d79204252" alt=""><figcaption></figcaption></figure>

Now, let's enable Elasticsearch to start automatically on system boot.

<pre class="language-bash"><code class="lang-bash">sudo systemctl daemon-reload
<strong>sudo systemctl enable elasticsearch
</strong></code></pre>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F4brJDdzXpuTVQ8lqbBQx%2FScreenshot(13).png?alt=media&#x26;token=8d65a74d-c105-411b-8575-3026efaa7bce" alt=""><figcaption></figcaption></figure>

Next, let's start the elasticsearch Service:

```bash
sudo systemctl start elasticsearch
sudo systemctl status elasticsearch
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FYyRvAIPjnl7OkdJHVPBC%2FScreenshot(14).png?alt=media&#x26;token=5caddaa1-5c8c-4d0d-a0f5-5a9a8f3d9e76" alt=""><figcaption></figcaption></figure>

Now, we need to confirm that Elasticsearch is running correctly and is accessible via HTTPS on `localhost:9200`.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FfjvNpjEAAyaroRee1Izd%2FScreenshot(16).png?alt=media&#x26;token=79c4a10c-9a6b-4ff9-826a-6fb65ed5d811" alt=""><figcaption></figcaption></figure>

We can also confirm the service is up and accessible using this command:

```bash
sudo curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FdoklEAcSomeY8yXgXGoc%2FScreenshot(17).png?alt=media&#x26;token=f921c57f-c634-41e7-84d4-44d2f5b70521" alt=""><figcaption></figcaption></figure>

* The file `/etc/elasticsearch/certs/http_ca.crt` is the CA certificate generated during Elasticsearch installation.

Now, let's install and configure Kibana. It is part of the Elastic Stack, so it uses the same repository we added for Elasticsearch.

```bash
sudo apt-get install kibana
```

Now, we need to edit **`kibana.yml`**  file to determine how it connects to Elasticsearch and how it behaves.

```bash
sudo nano /etc/kibana/kibana.yml
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FhZVSSpqIe43dXJFVeeQS%2FScreenshot(19).png?alt=media&#x26;token=52f34691-1bf4-4e89-9225-4cc20cb91ecb" alt=""><figcaption></figcaption></figure>

* **`server.port: 5601`** : the port on which Kibana will run
* **`server.host: "0.0.0.0"`** : the IP address Kibana will bind to (Setting this to `0.0.0.0` allows Kibana to be accessed from other machines on the network.)
* **`elasticsearch.hosts: ["http://localhost:9200"]`** : the Elasticsearch instance Kibana will connect to

Next, let's enable Kibana to ensures it starts automatically when the system boots.

```bash
sudo systemctl enable kibana
```

Then, let's start the Kibana service:

```bash
sudo systemctl start kibana
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FNv8xRPKH8JMgCvPFkESS%2FScreenshot(18).png?alt=media&#x26;token=9916cb77-0f7d-4f1d-b0b8-f1362dd208e0" alt=""><figcaption></figcaption></figure>

Now, let's make sure Kibana is running:

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FjLhhtSED3d3vG3wDrtzF%2FScreenshot(20).png?alt=media&#x26;token=cb5a1ea5-9d4e-48d1-897e-410b4a99c388" alt=""><figcaption></figcaption></figure>

Now, we need to generate an **enrollment token** for Kibana and using it to securely connect Kibana to Elasticsearch.

```bash
sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FudWRNgMcQxnsX45o768G%2FScreenshot(21).png?alt=media&#x26;token=50804809-3c89-4f37-8edb-59ebda440631" alt=""><figcaption></figcaption></figure>

Next, let's open Kibana, enter the copied token into the input field, and click **Configure Elastic** to proceed.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2Fq73rczpeGSpfgy59JvII%2FScreenshot(22).png?alt=media&#x26;token=e7fab611-bc5f-4508-8851-bef6ec2e2b32" alt=""><figcaption></figcaption></figure>

After this Kibana prompted for Verification code.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FRCmq0lwW6VEzHYffkZzT%2FScreenshot(23).png?alt=media&#x26;token=39c9bdd2-840c-40d5-a692-5bcb8b5a8f46" alt=""><figcaption></figcaption></figure>

To generate Verification code , we need to navigate to Kibana installation directory and execute the following script.

```bash
sudo /usr/share/kibana/bin/kibana-verification-code
```

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FETnf57gh6haIqkBiW2qf%2FScreenshot(24).png?alt=media&#x26;token=e2484df0-76b6-4197-aeca-df018811e8d5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F69Uwt7X4rMIZft7JSu2Y%2FScreenshot(25).png?alt=media&#x26;token=9bb8c220-5d53-462e-ba0a-3b62ac1f8f22" alt=""><figcaption></figcaption></figure>

Next, let's proceed with logging in using the provided username and password.

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2F4t31CH7d7oI4ljz3Nm7e%2FScreenshot(26).png?alt=media&#x26;token=953f7c87-05b2-46c9-be41-3346e6dd0a1b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2537271824-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FIswWWP3l0rGuQmG2WUcr%2Fuploads%2FHseuyGVywW4tzUPzizuK%2FScreenshot(27).png?alt=media&#x26;token=bc705026-6a53-46d2-99cc-d2cf71f97f7a" alt=""><figcaption></figcaption></figure>
