The ELK Stack: Elasticsearch, Logstash, Kibana

By Kokil Thapa | Last reviewed: September 2026

The ELK Stack: Elasticsearch, Logstash, Kibana is the classic trio for centralized logging. Your Laravel app, Nginx access logs, and PHP-FPM errors all land in one searchable place. I've used it on production servers where grep across a dozen files was no longer viable. This guide covers how the three components fit together, a practical Ubuntu install path, and patterns that survive real traffic. For a deeper pipeline walkthrough, see our centralized logging with the ELK stack companion post.

What is the ELK Stack and how do Elasticsearch, Logstash, and Kibana work together?

ELK stands for three open-source projects now maintained by Elastic. Elasticsearch is a distributed search and analytics engine built on Apache Lucene. Logstash is a server-side data pipeline that ingests, transforms, and forwards events. Kibana is the web UI where you search logs, build dashboards, and set alerts.

In practice, a web request generates lines in several places. Nginx writes an access entry. PHP-FPM may log a slow request. Your Laravel app writes to storage/logs/laravel.log. Without aggregation, debugging means SSH and tail across multiple hosts. ELK pulls those streams into indexed documents you query in seconds.

Elastic renamed the bundle to the Elastic Stack when Beats agents joined the family. Many teams still say ELK when they mean Elasticsearch plus a shipper plus Kibana. Filebeat often replaces Logstash on the edge for simple tail-and-forward workloads. Logstash stays valuable when you need heavy parsing, GeoIP enrichment, or multi-destination routing.

Elasticsearch stores JSON documents in indices—think tables split by time. Logstash reads inputs, runs a filter chain, and writes to an Elasticsearch output. Kibana connects to the same cluster and renders Discover views, Lens charts, and alert rules. That separation keeps indexing fast while the UI stays thin.

How do you install and configure the ELK Stack on Ubuntu in 2026?

A single-node lab stack fits a small VPS. Production needs more planning: disk IOPS, heap sizing, and TLS between components. I usually provision ELK on a dedicated host rather than co-locating it with a busy Laravel app. Our Linux system administration service often includes this split for client sites on Ubuntu 22/24.

Install Elasticsearch from Elastic packages

Add Elastic's APT repository, then install Elasticsearch 8.x. Pin a version in staging before rolling to production. Official install steps live in the Elasticsearch installation guide.

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list
sudo apt update
sudo apt install elasticsearch
sudo systemctl enable elasticsearch --now

Set network.host and enable security in /etc/elasticsearch/elasticsearch.yml. Reset the built-in elastic user password on first boot. Never expose port 9200 to the public internet without authentication and firewall rules.

Install Logstash and Kibana

sudo apt install logstash kibana
sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
sudo kibana-setup --enrollment-token <TOKEN>

Point Kibana at https://localhost:9200 using the service account credentials enrollment creates. Logstash needs its own output block with the same CA certificate Elasticsearch uses for TLS.

Minimal Logstash pipeline

Create /etc/logstash/conf.d/01-beats-input.conf:

input {
  beats {
    port => 5044
  }
}

filter {
  if [fields][service] == "laravel" {
    grok {
      match => { "message" => "\[%{TIMESTAMP_ISO8601:timestamp}\] %{DATA:env}\.%{LOGLEVEL:level}: %{GREEDYDATA:msg}" }
    }
  }
}

output {
  elasticsearch {
    hosts => ["https://localhost:9200"]
    user => "logstash_internal"
    password => "${LOGSTASH_PASSWORD}"
    index => "app-%{[fields][service]}-%{+YYYY.MM.dd}"
  }
}

Validate before restart: sudo /usr/share/logstash/bin/logstash --path.settings /etc/logstash -t. A syntax error here blocks the entire pipeline. Test with JSON formatter samples when you debug structured log payloads.

If you already run a LEMP stack on Ubuntu, place Filebeat on the app server and Logstash on the logging host. That keeps log shipping off the request path during traffic spikes.

What is the difference between the ELK Stack and the Elastic Stack?

The names overlap, but the scope differs. ELK historically meant Elasticsearch, Logstash, and Kibana only. Elastic Stack adds Beats (lightweight shippers), Elastic Agent, Fleet Server, and optional paid features under Elastic License 2.0.

For Magento shops, Elasticsearch also powers catalog search—a different use case from logging. See our Magento 2 Elasticsearch setup article for commerce search tuning. Logging indices and catalog indices should stay on separate clusters when load is high.

How do you ship Laravel and PHP application logs to the ELK Stack?

Laravel 12 and 13 default to Monolog via the logging config in config/logging.php. You can keep the daily file channel and tail it with Filebeat. That pattern is simple and survives deploys if storage/logs persists on the server.

Filebeat on the app server

Install Filebeat from the same Elastic APT repo. Point it at Laravel and PHP-FPM log paths:

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/www/app/storage/logs/laravel*.log
    fields:
      service: laravel
    fields_under_root: false

  - type: log
    enabled: true
    paths:
      - /var/log/php8.3-fpm.log
    fields:
      service: php-fpm

output.logstash:
  hosts: ["logstash.internal:5044"]

Use PHP 8.3 or 8.4 on Laravel 12; Laravel 13 requires PHP 8.3 minimum. Match the FPM log path to the installed PHP version. Full Beat reference docs are at elastic.co Filebeat guide.

Structured JSON logging (optional)

For dense apps—booking systems, payment callbacks, multi-tenant portals—JSON lines parse cleanly without fragile grok rules. Add a Monolog JSON formatter channel and log one object per line. On a legal-tech portal with document uploads, structured fields like user_id, action, and request_id cut investigation time sharply.

Projects like Adventure Third Pole Trek generate logs across booking, supplier CRM, and payment flows. Correlating by request_id in Kibana beats reading three separate files after a failed Khalti callback.

1. Enable a JSON log channel in Laravel for production.
2. Ship with Filebeat; add a Logstash json filter or Elasticsearch ingest pipeline.
3. Create a Kibana Data View matching app-laravel-*.
4. Build a Discover saved search filtered on level: error.
5. Add a dashboard panel for 5xx rates alongside Nginx access status codes.

Test grok patterns with our regex tester before pushing to production Logstash. One bad pattern drops events silently until you watch the Logstash dead letter queue.

When should you choose the ELK Stack over Prometheus and Grafana?

ELK and Prometheus solve different problems. Prometheus scrapes numeric metrics on an interval. ELK excels at semi-structured text: stack traces, request payloads, audit trails. Many teams run both.

Read our Prometheus and Grafana monitoring stack guide for the metrics side. Wire Alertmanager to page on high error rates, then use Kibana to read the actual exception. That workflow appears repeatedly on enterprise application projects I maintain.

ELK storage costs more per gigabyte than Prometheus TSDB blocks. Plan Index Lifecycle Management (ILM) to roll hot indices to warm tiers and delete after 30–90 days. Compliance-heavy clients may need longer cold storage; budget disk accordingly—often Rs 3,000–8,000/month (~USD 22–60) extra on a mid-size VPS.

How do you secure and scale Elasticsearch in production?

A exposed Elasticsearch cluster is a data breach waiting to happen. Enable TLS, role-based access control, and network isolation on day one. Bind Elasticsearch to a private interface; reach Kibana through VPN or an SSH tunnel during early setup.

Heap, shards, and nodes

Set JVM heap to 50% of RAM, capped around 31 GB to avoid compressed OOP issues. One shard per 10–50 GB of data is a workable starting rule. Oversharding hurts cluster state performance. Add data nodes horizontally before maxing a single machine.

Index Lifecycle Management

PUT _ilm/policy/app-logs-policy
{
  "policy": {
    "phases": {
      "hot": { "actions": { "rollover": { "max_size": "30gb", "max_age": "7d" } } },
      "delete": { "min_age": "60d", "actions": { "delete": {} } }
    }
  }
}

Attach the policy to index templates Logstash creates. Without ILM, a busy WooCommerce site can fill disk in weeks during sale season.

Ongoing tuning belongs in testing and optimization and support and maintenance retainers. Sister sites on shared EC2—deployed via Deployer 7 and GitLab CI—share centralized logging so one Kibana space covers multiple vhosts.

For automation-first teams, pairing ELK with Ansible playbooks for PHP provisioning keeps Filebeat configs consistent across fleets. AIOps workflows can layer anomaly detection on log rates, but you still need clean ingestion first.

Client portals like Mijar Law Associates benefit from audit-friendly retention. Document who accessed which file and when. ELK supports that narrative better than metrics alone. Pair with Prometheus Alertmanager for uptime signals.

If ELK feels heavy for a two-server setup, start with Filebeat directly to Elasticsearch and add Logstash only when parsing demands it. Scale up when log volume exceeds a few gigabytes per day or when full-text search latency matters for incident response.

Key Takeaways

• The ELK Stack: Elasticsearch, Logstash, Kibana ingests logs, indexes them for search, and exposes Kibana dashboards for debugging and audits.
• Use Filebeat on app servers and Logstash only when grok, enrichment, or multi-output routing is required.
• Ship Laravel logs as daily files or JSON lines; correlate incidents with request_id fields in Kibana Discover.
• Enable TLS, RBAC, and ILM from the start—unauthenticated Elasticsearch on port 9200 is a common production mistake.
• Run ELK alongside Prometheus: metrics tell you something broke; logs tell you why.
• Budget disk and plan retention; logging clusters grow faster than application databases on busy eCommerce sites.

People Also Ask

Is the ELK Stack still called ELK in 2026?

Yes, colloquially. Elastic prefers "Elastic Stack" because Beats and Elastic Agent are first-class shippers. Documentation and job posts still say ELK when they mean centralized logging with Elasticsearch and Kibana at the core.

Can Elasticsearch replace MySQL for application data?

No. Elasticsearch is optimized for search and analytics, not ACID transactions. Laravel apps should keep MySQL 9.7 or PostgreSQL 18 as the system of record. Use Elasticsearch for logs, full-text search, or analytics indices—not primary relational storage.

How much RAM does a small ELK server need?

A lab node with Elasticsearch, Logstash, and Kibana wants at least 8 GB RAM; 16 GB is safer once heap, OS cache, and Kibana share the box. Production clusters split roles across hosts so Elasticsearch heap does not compete with Logstash JVM usage.

Do I need a paid Elastic license for basic logging?

Core Elasticsearch, Logstash, Kibana, and Beats are free to use under Elastic License 2.0. Paid subscriptions add advanced security, machine learning, and official support. Many small teams self-host without a subscription and handle TLS and backups themselves.

Build observable systems that stay debuggable after launch

The ELK Stack: Elasticsearch, Logstash, Kibana turns noisy server output into something you can search during a 2 a.m. incident. Start small: Filebeat, one Logstash pipeline, one Kibana dashboard for errors. Expand when volume and compliance demand it. If you want help wiring centralized logging into a Laravel, WooCommerce, or legal-tech platform, review our API and integration work or about me page, browse the portfolio, and contact us to discuss your stack.