How to Install Logstash and Elasticsearch 7.17 on Ubuntu Desktop 22.04.5

If you’re building a custom SIEM (Security Information and Event Management) system or simply want to harness the power of the ELK stack on your Ubuntu machine, installing Logstash and Elasticsearch is a critical first step. In this tutorial, we’ll walk you through the process of installing Logstash and Elasticsearch version 7.17 on Ubuntu Desktop 22.04.5, using the command line as the root user.

This guide is perfect for developers, system administrators, and cybersecurity professionals looking to set up a lightweight, local instance of Elasticsearch and Logstash for development or testing purposes.

Prerequisites

Before we begin, make sure you:

• Have Ubuntu Desktop 22.04.5 installed
• Have root access to your system
• Have access to the internet to download packages

Open a terminal and log in as the root user to begin the installation process.

Step 1: Install Logstash on Ubuntu

1.1 Add the Elastic GPG Key

First, you need to add Elastic’s public signing key to your system. This key is used to verify the authenticity of the packages you download:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -

This command fetches the GPG key and adds it to your system’s keyring.

1.2 Install apt-transport-https

To fetch packages securely via HTTPS, you may need to install the apt-transport-https package:

sudo apt-get install apt-transport-https

1.3 Add the Elastic Package Repository

Next, add the Elastic repository to your sources list:

echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

This command ensures that you’re pulling version 7.17 (since it’s part of the 7.x line) from the correct repository.

1.4 Update Package List and Install Logstash

Now, update your local package index and install Logstash:

sudo apt-get update && sudo apt-get install logstash

This will install Logstash version 7.17 from the Elastic repository.

1.5 Start and Enable Logstash Service

To check if Logstash is installed properly, run:

systemctl status logstash

Initially, it may show as inactive. Start the service using:

systemctl start logstash

If you want Logstash to start automatically on boot:

systemctl enable logstash

Step 2: Install Elasticsearch on Ubuntu

Since you’ve already added the Elastic package repository in the earlier steps, installing Elasticsearch is straightforward.

2.1 Install Elasticsearch

Run the following command to install Elasticsearch version 7.17:

sudo apt-get install elasticsearch

This will install the appropriate version from the 7.x package repository.

2.2 Start and Enable Elasticsearch

Once installed, check the status of Elasticsearch:

systemctl status elasticsearch

It may be inactive after installation. Start the service using:

systemctl start elasticsearch

Elasticsearch might take a moment to start up. Once started, verify its status again:

systemctl status elasticsearch

It should now show as active (running).

To ensure Elasticsearch starts automatically on system reboot:

systemctl enable elasticsearch

You’ve now successfully installed both Logstash and Elasticsearch version 7.17 on your Ubuntu Desktop 22.04.5 machine. This setup forms a critical part of the ELK stack (Elasticsearch, Logstash, and Kibana), which is widely used for log analysis, monitoring, and security information event management (SIEM).

These services are now ready to be integrated with other tools or your custom scripts to process, store, and visualize data.

Summary of Commands

Here’s a quick recap of all key commands used in this tutorial:

For Logstash:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt-get update && sudo apt-get install logstash
systemctl status logstash
systemctl start logstash
systemctl enable logstash

For Elasticsearch:

sudo apt-get install elasticsearch
systemctl status elasticsearch
systemctl start elasticsearch
systemctl status elasticsearch
systemctl enable elasticsearch

Next Steps

With both services installed, you can:

• Install Kibana to complete the ELK stack
• Begin feeding log data into Logstash for parsing
• Configure Elasticsearch indices and mappings
• Build dashboards to visualize logs and metrics

Setting up this stack on a local Ubuntu Desktop provides an excellent environment for learning, development, and testing. Whether you’re exploring data analytics, building security tools, or creating custom dashboards, you now have a solid foundation.