How To Install Elasticsearch, Logstash, and Kibana (Elastic Stack) on CentOS 7?

Updated: 28 September 2026 · Applies to: Elastic Stack 9.x on Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9

CentOS 7 is end of life. The Elastic Stack (formerly ELK: Elasticsearch, Logstash, Kibana) collects, searches and visualises logs. This guide installs version 9.x on Ubuntu 24.04, Debian 12, AlmaLinux 9 and Rocky Linux 9.

Requirements

• At least 4 GB RAM for a small single-node setup (8 GB or more recommended); Elasticsearch sizes its Java heap automatically.
• Elasticsearch includes its own Java runtime; you do not need to install Java.

Add the Elastic repository (version 9.x)

# Ubuntu 24.04 / Debian 12
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/9.x/apt stable main" > /etc/apt/sources.list.d/elastic-9.x.list
apt update

On AlmaLinux/Rocky 9 create /etc/yum.repos.d/elasticsearch.repo:

[elasticsearch]
name=Elastic repository for 9.x packages
baseurl=https://artifacts.elastic.co/packages/9.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
type=rpm-md

Install Elasticsearch

apt install elasticsearch        # or: dnf install elasticsearch
systemctl daemon-reload
systemctl enable --now elasticsearch

Security is on by default: the installer prints the password of the elastic superuser (reset it any time with /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic) and creates TLS certificates. Test it:

curl --cacert /etc/elasticsearch/certs/http_ca.crt -u elastic https://localhost:9200

Elasticsearch listens only on the server itself by default; keep port 9200 closed to the internet.

Install Kibana

apt install kibana        # or: dnf install kibana
/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
/usr/share/kibana/bin/kibana-setup --enrollment-token <token>
systemctl enable --now kibana

Kibana listens on localhost:5601. Log in with the elastic user. To reach it from your computer, use an SSH tunnel (ssh -L 5601:localhost:5601 root@SERVER-IP) or the Nginx proxy below.

Collect logs

• Elastic Agent / Filebeat: the usual way to ship log files from your servers (apt install filebeat from the same repository). Enable a module, for example filebeat modules enable nginx system, point it at Elasticsearch in /etc/filebeat/filebeat.yml, then filebeat setup and systemctl enable --now filebeat.
• Logstash (apt install logstash): for parsing and transforming logs before storing them. Pipelines go in /etc/logstash/conf.d/.

Publish Kibana through Nginx with HTTPS

In /etc/kibana/kibana.yml set server.publicBaseUrl: "https://kibana.example.com" and restart Kibana. Then create an Nginx server block:

server {
    listen 80;
    server_name kibana.example.com;
    location / {
        proxy_pass http://127.0.0.1:5601;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Reload Nginx and add a certificate with certbot --nginx -d kibana.example.com. Kibana has its own login, so a separate Nginx password is optional; restricting the site to your IPs (allow / deny) adds another layer. On AlmaLinux/Rocky also run setsebool -P httpd_can_network_connect 1.