Install ubuntu 18.04 and do the latest dist-upgrade dance.

Install java..

sudo apt install openjdk-8-jre-headless

Install elastic stack


wget -qO - | sudo apt-key add -
echo "deb stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-6.x.list

sudo apt update; sudo apt -y install elasticsearch

sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable elasticsearch.service

sudo systemctl start elasticsearch.service


sudo apt -y install kibana

sudo /bin/systemctl daemon-reload
sudo /bin/systemctl enable kibana.service

sudo systemctl start kibana.service


sudo apt -y install logstash

Make elasticsearch listen on localhost

sudo sed -i 's|| localhost|g' /etc/elasticsearch/elasticsearch.yml
sudo systemctl restart elasticsearch

Make kibana accesible from world (REMEMBER WORLD / NO AUTH!)

sudo sed -i 's| "localhost"| ""|g' /etc/kibana/kibana.yml
sudo systemctl restart kibana

Set jvm mem settings

sudo sed -i 's|-Xms1g|-Xms4g|g' /etc/logstash/jvm.options
sudo sed -i 's|-Xmx1g|-Xmx4g|g' /etc/logstash/jvm.options

Add req. plugins

sudo /usr/share/logstash/bin/logstash-plugin install logstash-codec-sflow
sudo /usr/share/logstash/bin/logstash-plugin update logstash-codec-netflow
sudo /usr/share/logstash/bin/logstash-plugin update logstash-input-udp
sudo /usr/share/logstash/bin/logstash-plugin update logstash-filter-dns

Clone elastiflow

cd /usr/local/src
sudo git clone

Copy the logstash config

sudo cp -arv elastiflow/logstash/elastiflow/. /etc/logstash/elastiflow/

Copy env files

sudo cp -arv elastiflow/logstash.service.d/. /etc/systemd/system/logstash.service.d/

This is really important that syntax is ok. Otherwise this will bork the whole funktion :)

sudo cp /etc/logstash/pipelines.yml /etc/logstash/pipelines.yml-DIST
sudo tee -a /etc/logstash/pipelines.yml << EOF

- elastiflow
  path.config: "/etc/logstash/elastiflow/conf.d/*.conf"

if you want to check your yamlfile.

sudo apt install -y yamllint
yamllint /etc/logstash/pipelines.yml

sudo /usr/share/logstash/bin/system-install

sudo systemctl daemon-reload sudo systemctl start logstash

sudo tail /var/log/logstash/logstash-plain.log -f