When installing x-pack to any component of the elastic stack (elasticsearch, logstash, kibana, filebeat), is there any requirement that x-pack must be installed on all other components? For example, if I install x-pack on logstash, is there any hard requirement that we need to install x-packs on all elasticsearch, kibana, and filebeat (in order to maintain a functional stack)?
If you install xpack on logstash for security and/or monitoring features then yes you need to install xpack on elasticsearch and Kibana.
If you don't use those features, then don't install xpack at all.
(I recommend using xpack monitoring at least)
Thank you for the quick response!
If I were to install x-pack on both elasticsearch and kibana, do I have to install x-pack on the logstash and filebeat as well? Or can I do away with installing x-pack on logstash?
If you are using security on elasticsearch side: yes.
If you want to monitor logstash: yes.
There is no plugin AFAIK on filebeat.
May be explain exactly what you want to do and we can go straight to the point?
I would like to install x-pack (including security) on ES and kibana and I would like to understand the dependency of x-pack installation. I would assume that if I install x-pack on ES & Kibana, I would also need to install x-pack on Logstash as well (so it can communicate to ES securely).
+1 to filebeat not having to install x-pack for this to work 
In general:
- install x-pack on the whole stack
- don't install x-pack at all
I would assume that if I install x-pack on ES & Kibana, I would also need to install x-pack on Logstash as well (so it can communicate to ES securely).
Yes.
BTW in the future x-pack will be part of the default distribution as announced at elastic{ON}'18.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.