---
title: "Cloud server with ELK"
sidebar_label: "ELK"
sidebar_position: 13
toc_max_heading_level: 3
description: "How to create a cloud server for data management and search"
---

import EditIcon from '@selectel/docux/icons/edit'
import CheckIcon from '@selectel/docux/icons/check'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
import {CustomTable} from '@selectel/docux/components'
import Formbricks from '@theme/MDXComponents/Formbricks'
import CopyIcon from '@selectel/docux/icons/copy'
import CreateServer from '@site/i18n/en/docusaurus-plugin-content-docs/current/_partials/cloud-servers/applications/create-server-for-apps.mdx'

# Cloud server with ELK

ELK (Elasticsearch, Logstash, Kibana) is a set of open-source tools for analyzing and visualizing logs and other data.

In Selectel, a cloud server with ELK includes:

* Elasticsearch — an open distributed data management and search system based on the Apache Lucene search engine. The system provides powerful capabilities for indexing, storing, searching, and analyzing large volumes of information in real time;
* Kibana — a web interface for monitoring, analyzing Elasticsearch logs, and presenting data on dashboards;
* Filebeat — an agent for collecting logs and transferring them to Elasticsearch;
* Metricbeat — an agent for collecting metrics and transferring them to Elasticsearch.

You can [create a cloud server with the ELK application pre-installed](#create-cloud-server-with-elk). In Russia, the server runs on a cloud server with [SelectOS 1 64-bit](https://selectos.selectel.ru/news/mega/) configured. In other [countries](/infrastructure/locations/#country) — Ubuntu 22.04.

Before creating a cloud server with an application, please read the [software license agreements](https://423.selcdn.ru/kb/license-agreements-for-application-images-LANG.pdf) included with the image.

## Minimum resource requirements \{#minimum-requirements}

<CustomTable>
  <table>
    <tbody>
      <tr>
        <th>Number of vCPUs</th><td>4</td>
      </tr>

      <tr>
        <th>RAM</th><td>10 GB</td>
      </tr>

      <tr>
        <th>Boot volume</th><td>30 GB</td>
      </tr>
    </tbody>
  </table>
</CustomTable>

## Create a cloud server with ELK \{#create-cloud-server-with-elk}

For ELK to work, the cloud server must be accessible from the internet. To do this, when creating the server, you need to create a private subnet and attach a public floating IP address. To set up ELK, you must specify user data — custom operating system configuration parameters — when creating the server.

After the server with ELK is created, a free [TLS certificate from Let’s Encrypt®](/certificates-manager/certificates/lets-encrypt.mdx) will be automatically issued for the domain you specify. To issue the certificate, you need to add an A record for the domain and specify the server's public floating IP address as the record value. You can add the domain to [Selectel DNS Hosting (actual](/dns-hosting/)).

1. [Create a public floating IP address](#create-floating-ip).

2. [Add an A record for the domain](#add-a-record).

3. [Create a cloud server with ELK](#create-elk-server).

### 1. Create a public floating IP address \{#create-floating-ip}

Create a public floating IP address so that the cloud server with ELK is accessible from the internet.

Use the [Create a public floating IP address](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx#create-public-floating-ip) section of the [Public Floating IP addresses](/cloud-servers/cloud-networks/public-floating-ip-addresses.mdx).

### 2. Add an A record for the domain \{#add-a-record}

[Add a resource record](/dns-hosting/records/add-record.mdx) to access ELK by domain.

Specify:

* [resource record type](/dns-hosting/records/add-record.mdx#record-types) — A; ;
* record value — the public floating IP address that you [created in step 1](#create-floating-ip).

### 3. Create a cloud server with ELK \{#create-elk-server}

<CreateServer AppNameInPanel="Cloud ELK" MinConfig="4 vCPU, RAM starting from 10 GB and a boot disk size starting from 30 GB" OptionalVolumes="Optional: add an additional" VolumeSize="Specify the size of the network disk in GB or TB" />

<div style={{paddingLeft:'2em'}}>
  ```yaml
  #cloud-config

  write_files:
  - path: "/opt/gomplate/values/user-values.yaml"
    permissions: "0644"
    content: |   
      username: "<kibana_username>"
      password: "<kibana_password>"
      domain: "<example.com>"
      email: "<root@example.com>"
  ```

  Specify:

  * `<kibana_username>` — the administrator name for logging in to Kibana. Do not use the name `elastic` — it is reserved by the system; ;
  * `<kibana_password>` — Kibana administrator password; ;
  * `<example.com>` — the domain for accessing ELK that you [added in stage 2](#add-a-record);;
  * `<root@example.com>` — Kibana administrator email for account creation and receiving Let’s Encrypt® notifications.
</div>

## Install Filebeat on the observed servers \{#install-filebeat-on-monitored-servers}

Filebeat is installed on the servers from which you want to collect monitoring data. Filebeat collects log messages from log files and forwards them to the cloud server with Elasticsearch for indexing.

1. First, create a Kibana user with the necessary permissions and roles in the ELK web interface. For details, see the [Create a user](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/quickstart#_create_a_user) instruction in the Elastic documentation.

2. Install Filebeat. For details, see the [Install Filebeat](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-installation-configuration#installation) instruction in the Elastic documentation.

   &#x20;To install on Ubuntu, you can download the distribution from our [mirror](https://mirror.selectel.ru/3rd-party/elasticsearch-8.x/pool/main/f/filebeat/).

3. Download the CA public certificate from the cloud server to connect Filebeat via the HTTPS protocol:

   ```bash
   cd /etc/filebeat && wget https://<example.com>/ca.crt
   ```

   Specify `<example.com>` — the domain for accessing Elasticsearch that you [added in stage 2](#add-a-record).

4. Open the configuration file `/etc/filebeat/filebeat.yml` in a text editor.

5. Add the Elasticsearch connection parameters to the configuration file:

   ```bash
   outputs:
     default:
       type: elasticsearch
       hosts: [https://<example.com>:9200]
       username: "<username>"
       password: "<password>"
       ssl.enabled: true
       ssl.certificate_authorities: "/etc/filebeat/ca.crt"
   ```

   Specify:

   * `<example.com>` — the domain for accessing ELK that you [added in stage 2](#add-a-record);;
   * `<username>` — the Kibana username you created in step 1; ;
   * `<password>` — the Kibana user password you created in step 1.

6. Restart the agent:

   ```bash
   systemctl restart filebeat
   ```

## Install Elastic Agent on the observed servers \{#install-elastic-agent-on-monitored-servers}

Elastic Agent is installed on the servers from which you want to collect metrics, logs, and security events. The agent collects information and forwards it to the cloud server with Elasticsearch.

1. First, create a Kibana user with the necessary permissions and roles in the ELK web interface. For details, see the [Create a user](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/quickstart#_create_a_user) instruction in the Elastic documentation.

2. Install Elastic Agent. For details, see the [Install Elastic Agents](https://www.elastic.co/docs/reference/fleet/install-elastic-agents) instruction in the Elastic documentation.

   &#x20;To install on Ubuntu, you can download the distribution from our [mirror](https://mirror.selectel.ru/3rd-party/elasticsearch-8.x/pool/main/e/elastic-agent/).

3. Download the CA public certificate from the cloud server to connect Elastic Agent via the HTTPS protocol:

   ```bash
   cd /etc/elastic-agent && wget https://<example.com>/ca.crt
   ```

   Specify `<example.com>` — the domain for accessing Elasticsearch that you [added in stage 2](#add-a-record).

4. Open the configuration file `/etc/elastic-agent/elastic-agent.yml` in a text editor.

5. Add the Elasticsearch connection parameters to the configuration file:

   ```bash
   outputs:
     default:
       type: elasticsearch
       hosts: [https://<example.com>:9200]
       username: "<username>"
       password: "<password>"
       ssl.enabled: true
       ssl.certificate_authorities: "/etc/elastic-agent/ca.crt"
   ```

   Specify:

   * `<example.com>` — the domain for accessing ELK that you [added in stage 2](#add-a-record);;
   * `<username>` — the Kibana username you created in step 1; ;
   * `<password>` — the Kibana user password you created in step 1.

6. Restart the agent:

   ```bash
   systemctl restart elastic-agent
   ```

<Formbricks />