elk stack on mac

The installation matrix for the ELK Stack (Elasticsearch, Logstash and Kibana) is extremely varied, with Linux, Windows and Docker all being supported. For development purposes, installing the stack on Mac OS X is a more frequent scenario.

Without further adieu, let’s get down to business.

Installing Homebrew

To install the stack on Mac you can download a .zip or tar.gz package. This tutorial, however, uses Homebrew to handle the installation.

Make sure you have it installed. If not, you can use the following command in your terminal:

If you already have Homebrew installed, please make sure it’s updated:

Installing Java

The ELK Stack requires Java 8 to be installed.

To verify what version of Java you have, use:

To install Java 8 go here.

Installing Elasticsearch

Now that we’ve made sure our system and environment have the required pieces in place, we can begin with installing the stack’s components, starting with Elasticsearch:

Start Elasticsearch with Homebrew:

Use your favorite browser to check that it is running correctly on localhost and the default port: http://localhost:9200

The output should look something like this:

Localhost

Installing Logstash

Your next step is to install Logstash:

You can run Logstash using the following command:

Since we haven’t configured a Logstash pipeline yet, starting Logstash will not result in anything meaningful. We will return to configuring Logstash in another step below.

Installing Kibana

Finally, let’s install the last component of ELK – Kibana.

Start Kibana and check that all of ELK services are running.

start kibana

Kibana will need some configuration changes to work.

Open the Kibana configuration file:  kibana.yml

Uncomment the directives for defining the Kibana port and Elasticsearch instance:

elasticsearch instance

If everything went well, open Kibana at http://localhost:5601/status. You should see something like this:

status green

Congratulations, you’ve successfully installed ELK on your Mac!

Since this is a vanilla installation, you have no Elasticsearch indices to analyze in Kibana. We will take care of that in the next step.

Shipping some data

You are ready to start sending data into Elasticsearch and enjoy all the goodness that the stack offers. To help you get started, here is an example of a Logstash pipeline sending syslog logs into the stack.

First, you will need to create a new Logstash configuration file:

Enter the following configuration:

Then, restart the Logstash service:

In the Management tab in Kibana, you should see a newly created “syslog-demo” index created by the new Logstash pipeline.

create index pattern

Enter it as an index pattern, and in the next step select the @timestamp field as your Time Filter field name.

timestamp

And…you’re all set! Open the Discover page and you’ll see syslog data in Kibana.

discover page

 

Need help managing your ELK Stack? Logz.io can do the heavy lifting for you.