Seeking advice on setting up the ELK Stack

Elastic Stack Elasticsearch
1

Hey there.

I want to set up the ELK stack, and I'm wondering about a good way to set it up.

I'm running Proxmox so I have the options of either VMs or LXCs (was thinking of going with LXCs).

My main question is should it all just be ran in the same LXC/VM, all in separate LXCs/VMs, or maybe with some parts together and some parts separately?

Any thoughts? Sorry if this seems like a dumb question!

(For clarification, LXC refers to a Linux container.)

2

I'm going to preface my response by stating I'm not familiar with LXC.

The answer here somewhat depends on your own objectives, but if you're looking to just spin up a stack to learn/tinker with Elastic, I'd recommend setting up a single Linux VM, install Docker (and Docker Compose) and follow one of these guides.

(Side Note: There isn't a single node Docker Compose file, but you can use the multi-node compose file and just delete any/all references to esm02 and esm03. There is also a simple one for Enterprise Search setup that is single node as well).

The main reason I recommend going with Docker & Docker-Compose for learning/tinkering is it is probably the "least friction" method for setting up an Elastic Stack these days.

If you're more interested in setting up/learning how to operate a production grade Elastic Stack, I'd recommend again looking at using Docker for this, just spreading the Elasticsearch nodes across multiple hosts.

Depending on how "fancy" you want to get, Elastic ECK is a pretty good way to deploy the Elastic Stack on Kubernetes.

Opinionated Note: These days in general I avoid using things like rpm and deb package installs and would definitely avoid building any sort of "custom" deployment methods. The Elastic Stack is a pretty complex beast with all the products it includes and can become a challenge to deal with when mixing in "customizations". Docker (or containers in general) I've found to provide the most "reliable/consistent" deployment method.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.