Install and Configure Elasticsearch & Kibana

This page explains how to install an Elasticsearch/Kibana server for uberAgent.

Prerequisites

Java

Run the installer, e.g. jdk-9.0.1_windows-x64_bin.exe.

Set the JAVA_HOME environment variable, e.g. by running the following command on an elevated command prompt:

setx JAVA_HOME "C:\Program Files\Java\jdk-9.0.1" /m

Elasticsearch

Installation

Install the appropriate MSI file, e.g. elasticsearch-6.0.0.msi.

uberAgent - Elasticsearch installation step 1

Use default settings.

uberAgent - Elasticsearch installation step 2

Automatically install Elasticsearch as a Windows service in the context of LocalSystem.

uberAgent - Elasticsearch installation step 3

Optional: Configure network binding during installation.

uberAgent - Elasticsearch installation step 4

Optional: Enable Plugins like X-Pack.

uberAgent - Elasticsearch installation step 5

Optional: Choose the X-Pack license mode.

uberAgent - Elasticsearch installation step 7

Finish the installation process.

Configuration

Elasticsearch is configured through the config file C:\ProgramData\Elastic\Elasticsearch\config\elasticsearch.yml.

By default Elasticsearch listens on port 9200, but only on loopback addresses. To configure Elasticsearch to listen on local addresses, too, add the following:

network.host: ["_local_", "_site_"]

Settings that most likely should be configured, too, but are not required:

  • cluster.name
  • node.name

Once you have finished configuring Elasticsearch, restart the system service Elasticsearch, e.g. through PowerShell:

Get-Service Elasticsearch | Restart-Service

Configuration for uberAgent

Run the following PowerShell command on the Elasticsearch server to create an index template for uberAgent with the required field definitions:

Invoke-RestMethod -Uri http://localhost:9200/_template/uberagent -Method Put -InFile .\elasticsearch-uberagent.json -ContentType "Application/json"

The file elasticsearch-uberagent.json is part of the uberAgent download package.

Kibana

Installation

Unzip the Kibana archive to a directory of your choice. In this guide we are going to use C:\Program Files\Kibana. You should now have a directory C:\Program Files\Kibana\bin.

To manually run Kibana execute Kibana.bat from the bin directory

Configuration

Kibana is configured through the config file C:\Program Files\Kibana\config\kibana.yml. In the default configuration Kibana connects to the local Elasticsearch instance on port 9200.

To enable logging create the directory C:\Program Files\Kibana\log:

md "C:\Program Files\Kibana\log"

In Kibana.yml add:

logging.dest: "C:/Program Files/Kibana/log/Kibana.log"

By default Kibana listens on port 5601, but only on loopback addresses. To configure Kibana to listen on local addresses, too, add the following:

server.host: "0.0.0.0"

Running Kibana as a Windows Service

Download NSSM and extract NSSM.exe to C:\Program Files\NSSM.

To create the Kibana service:

"C:\program files\nssm\nssm.exe" install "Kibana" "C:\Program Files\Kibana\node\node.exe" "\"C:\Program Files\Kibana\src\cli\""

The startup type will be automatic. Now start the Kibana service.

Access Kibana in your Browser

The following works best if you already have uberAgent data in Elasticsearch.

  • Navigate to the URL http://kibana-server:5601.
  • You will be asked to configure an index pattern.
  • Enter as index name: uberagent*.
  • Leave the time field selection at “time”.

Your screen should now look similar to this:

uberAgent - Elasticsearch installation step 8

Firewall

Open these ports for inbound communication on the Elasticsearch/Kibana server:

  • 9200, TCP, Elasticsearch HTTP REST endpoint (where uberAgent sends ist data)
  • 9300, TCP, Elasticsearch cluster communication (not required if there is only one server)
  • 5601 TCP, Kibana (web interface)

Install uberAgent

Read on about how to install uberAgent.

To configure uberAgent to send data to Elasticsearch a configuration section similar to the following is required:

[Receiver]
Name = Default
Type = Elasticsearch
Protocol = HTTP
Servers = http://servername:9200