How to Implement ELK Stack for Windows Monitoring?

How to Implement ELK Stack for Windows Monitoring

What is ELK?

“ELK” is the acronym for three open source projects: Elasticsearch, Logstash, and Kibana. Elasticsearch is a search and analytics engine. Logstash is a server‑side data processing pipeline that simultaneously ingests data from multiple sources, transforms it, and then sends it to a “stash” like Elasticsearch. Kibana lets users visualize data with charts and graphs in Elasticsearch

Environment:

  • ElasticSearch Logstash Kibana 
  • Metricbeat and Winlogbeat 

Explanation:

Prerequisite

Install latest JDK version and set JAVA_HOME Variable in environment variable. 

Installation of Elasticsearch

  • Download Elasticsearch for windows from the link
  • Unzip Elasticsearch in one folder i.e., C:\ELKStack
  • Copy path till bin folder i.e., C:\ELKStack\elasticsearch-7.8.1-windows-x86_64\elasticsearch-7.8.1\bin and set this path into environment variable under Path variable
Environment variable
  • Run Elasticsearch.bat in command prompt (Make sure run command prompt as administrator)
  • Check that Elasticsearch is up and running using localhost:9200 or ipaddress:9200 in any browser.
  • For a more detailed installation process, please refer to this link

Installation of Kibana

  1. Download Kibana for windows from the link
  2. Unzip Kibana in one folder i.e., C:\ELKStack
  3. Copy path till bin folder, i.e., C:\ELKStack\kibana-7.8.1-windows-x86_64\kibana-7.8.1-windows-x86_64\bin and set this path into environment variable under Path variable.
Kibana Installation

Windows Monitoring

To implement windows monitoring, you have to install a winlogbeat to fetch the windows event data and enable some configuration in the yml file. 

Steps:

1. Download the Winlogbeat zip file from the link

2. Extract the contents into C:\Program Files

3. Rename the winlogbeat-<version> directory to Winlogbeat

4. Configure winlogbeat.yml file

a. Set the host and port where Winlogbeat can find the Elasticsearch installation, and set the username and password of a user who is authorized to set up Winlogbeat.

b. Note: Username and password is optional

Setup Kibana

c. If you plan to use pre-built Kibana dashboards, configure the Kibana endpoint. Skip this step if Kibana is running on the same host as Elasticsearch.

6. Start winlogbeat service from service.msc

7. Open the kibana application from localhost:5601, go to the dashboard tab, and find the dashboard that is enabled through winlogbeat. For example, some are some below:

Kibana application

Azure and AWS Monitoring

To implement azure and AWS KPI in kibana, you need to install metericbeat and change some configuration in metricbeat.yml file.

Steps:

  • Download the Metricbeat zip file from the link
  • Extract the contents into C:\Program Files
  • Rename the Metricbeat -<version> directory to Metricbeat
  • Configure metricbeat.yml file

a. Set the host and port where metricbeat can find the Elasticsearch installation, and set the username and password of a user authorized to set up Metricbeat.

b. Note: Username and password is optional

c. If you plan to use pre-built Kibana dashboards, configure the Kibana endpoint. Skip this step if Kibana is running on the same host as Elasticsearch.

Note: Username and password is optional

8. Start metricbeat service from service.msc

9. Open the kibana application from localhost:5601, go to the dashboard tab, and find the dashboard that is enabled through metricbeat. For example, some are some below:

Kibana app

10. Also, many pre-built dashboards are loaded in Kibana, which includes the Azure and AWS monitoring shown below:

Kibana Prebuild dashboard

11.  If you want to add a new dataset, then you need to change the index pattern of the metricbeat from where the data sets are loaded. The image below displays the index pattern in kibana:

New dataset in Kibana

Users can load the data from here.

We hope you are now thorough in how ELK Stack implementation is easy and doable. In case you still have any queries, do not hesitate to get in touch with an expert at DEV IT here.

The following two tabs change content below.
Anjali Maithani is a computer engineer by education and a senior software developer by profession. With over four years of experience as a software engineer, Anjali is an expert at BI technologies. During her time of leisure, Anjali likes to explore new technologies, travel, and listen to music. She aims to learn more about BI technologies in the future.

Latest posts by Anjali Maithani (see all)

Leave a Reply

Your email address will not be published. Required fields are marked *