Configure ELK stack for centralized logging with Elasticsearch 8, Logstash 8, and Kibana 8

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Global variables
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ELASTIC_PASSWORD=""
KIBANA_TOKEN=""

# Print colored output
print_status() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

print_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Install and configure ELK Stack (Elasticsearch 8, Logstash 8, Kibana 8)"
    echo ""
    echo "Options:"
    echo "  -h, --help              Show this help message"
    echo ""
    echo "Example:"
    echo "  sudo $0"
    exit 1
}

# Cleanup function
cleanup() {
    print_error "Installation failed. Cleaning up..."
    systemctl stop elasticsearch kibana logstash 2>/dev/null || true
    systemctl disable elasticsearch kibana logstash 2>/dev/null || true
    exit 1
}

# Set up error handling
trap cleanup ERR

# Check if running as root
check_root() {
    if [[ $EUID -ne 0 ]]; then
        print_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Detect Linux distribution
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update"
                PKG_INSTALL="apt install -y"
                FIREWALL_CMD="ufw"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                FIREWALL_CMD="firewall-cmd"
                # Check if dnf exists, fallback to yum
                if ! command -v dnf &> /dev/null; then
                    PKG_MGR="yum"
                    PKG_UPDATE="yum update -y"
                    PKG_INSTALL="yum install -y"
                fi
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                FIREWALL_CMD="firewall-cmd"
                ;;
            *)
                print_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        print_error "Cannot detect Linux distribution"
        exit 1
    fi
    print_success "Detected distribution: $ID"
}

# Parse command line arguments
parse_args() {
    while [[ $# -gt 0 ]]; do
        case $1 in
            -h|--help)
                usage
                ;;
            *)
                print_error "Unknown option: $1"
                usage
                ;;
        esac
    done
}

# Install Java 17
install_java() {
    print_status "[1/8] Installing Java 17..."
    
    if command -v java &> /dev/null; then
        JAVA_VERSION=$(java -version 2>&1 | head -n1 | cut -d'"' -f2 | cut -d'.' -f1)
        if [[ "$JAVA_VERSION" == "17" ]]; then
            print_success "Java 17 already installed"
            return
        fi
    fi

    case "$PKG_MGR" in
        apt)
            $PKG_INSTALL openjdk-17-jdk
            ;;
        dnf|yum)
            $PKG_INSTALL java-17-openjdk java-17-openjdk-devel
            ;;
    esac
    
    print_success "Java 17 installed successfully"
}

# Add Elastic repository
add_elastic_repo() {
    print_status "[2/8] Adding Elastic repository..."
    
    case "$PKG_MGR" in
        apt)
            # Install required packages
            $PKG_INSTALL wget gnupg
            
            # Add GPG key
            wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg
            
            # Add repository
            echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" > /etc/apt/sources.list.d/elastic-8.x.list
            
            $PKG_UPDATE
            ;;
        dnf|yum)
            # Import GPG key
            rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
            
            # Add repository
            cat > /etc/yum.repos.d/elasticsearch.repo << EOF
[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
            ;;
    esac
    
    print_success "Elastic repository added successfully"
}

# Install Elasticsearch
install_elasticsearch() {
    print_status "[3/8] Installing Elasticsearch..."
    
    $PKG_INSTALL elasticsearch
    
    # Enable and start Elasticsearch
    systemctl daemon-reload
    systemctl enable elasticsearch
    systemctl start elasticsearch
    
    # Wait for Elasticsearch to start and get the elastic password
    sleep 10
    
    # Reset elastic password and capture it
    ELASTIC_PASSWORD=$(echo "y" | /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic -s 2>/dev/null)
    
    print_success "Elasticsearch installed successfully"
    print_status "Elastic user password: $ELASTIC_PASSWORD"
}

# Install and configure Kibana
install_kibana() {
    print_status "[4/8] Installing and configuring Kibana..."
    
    $PKG_INSTALL kibana
    
    # Generate enrollment token for Kibana
    KIBANA_TOKEN=$(/usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana)
    
    # Configure Kibana with enrollment token
    echo "$KIBANA_TOKEN" | /usr/share/kibana/bin/kibana-setup --enrollment-token
    
    # Configure Kibana
    cat > /etc/kibana/kibana.yml << EOF
server.host: "0.0.0.0"
server.port: 5601
elasticsearch.hosts: ["https://localhost:9200"]
EOF
    
    chown root:kibana /etc/kibana/kibana.yml
    chmod 644 /etc/kibana/kibana.yml
    
    # Enable and start Kibana
    systemctl daemon-reload
    systemctl enable kibana
    systemctl start kibana
    
    print_success "Kibana installed and configured successfully"
}

# Install and configure Logstash
install_logstash() {
    print_status "[5/8] Installing and configuring Logstash..."
    
    $PKG_INSTALL logstash
    
    # Create basic Logstash configuration
    mkdir -p /etc/logstash/conf.d
    
    cat > /etc/logstash/conf.d/01-beats-input.conf << EOF
input {
  beats {
    port => 5044
  }
}
EOF
    
    cat > /etc/logstash/conf.d/02-syslog-filter.conf << EOF
filter {
  if [fileset][module] == "system" {
    if [fileset][name] == "auth" {
      grok {
        match => { "message" => ["%{SYSLOGTIMESTAMP:[system][auth][timestamp]} %{IPORHOST:[system][auth][hostname]} sshd(?:\[%{POSINT:[system][auth][pid]}\])?: %{DATA:[system][auth][ssh][event]} %{DATA:[system][auth][ssh][method]} for (invalid user )?%{DATA:[system][auth][user]} from %{IPORHOST:[system][auth][ssh][ip]} port %{INT:[system][auth][ssh][port]} ssh2(: %{GREEDYDATA:[system][auth][ssh][signature]})?"] }
        remove_field => "message"
      }
    }
  }
}
EOF
    
    cat > /etc/logstash/conf.d/30-elasticsearch-output.conf << EOF
output {
  elasticsearch {
    hosts => ["localhost:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    user => "elastic"
    password => "$ELASTIC_PASSWORD"
    ssl => true
    ssl_certificate_verification => false
  }
}
EOF
    
    chown -R root:logstash /etc/logstash/
    chmod 644 /etc/logstash/conf.d/*.conf
    
    # Enable and start Logstash
    systemctl daemon-reload
    systemctl enable logstash
    systemctl start logstash
    
    print_success "Logstash installed and configured successfully"
}

# Configure firewall
configure_firewall() {
    print_status "[6/8] Configuring firewall..."
    
    case "$FIREWALL_CMD" in
        ufw)
            if command -v ufw &> /dev/null; then
                ufw allow 9200/tcp comment "Elasticsearch"
                ufw allow 5601/tcp comment "Kibana"
                ufw allow 5044/tcp comment "Logstash Beats"
                print_success "UFW rules added"
            fi
            ;;
        firewall-cmd)
            if command -v firewall-cmd &> /dev/null && systemctl is-active firewalld &> /dev/null; then
                firewall-cmd --permanent --add-port=9200/tcp
                firewall-cmd --permanent --add-port=5601/tcp
                firewall-cmd --permanent --add-port=5044/tcp
                firewall-cmd --reload
                print_success "Firewalld rules added"
            fi
            ;;
    esac
}

# Verify installation
verify_installation() {
    print_status "[7/8] Verifying installation..."
    
    # Check if services are running
    for service in elasticsearch kibana logstash; do
        if systemctl is-active --quiet "$service"; then
            print_success "$service is running"
        else
            print_error "$service is not running"
            return 1
        fi
    done
    
    # Test Elasticsearch
    sleep 5
    if curl -k -u "elastic:$ELASTIC_PASSWORD" https://localhost:9200 &> /dev/null; then
        print_success "Elasticsearch is responding"
    else
        print_warning "Elasticsearch may still be starting up"
    fi
    
    print_success "All services verified"
}

# Print final information
print_final_info() {
    print_status "[8/8] Installation completed!"
    echo ""
    print_success "ELK Stack has been installed successfully!"
    echo ""
    echo "Access Information:"
    echo "  Kibana Web UI: http://$(hostname -I | awk '{print $1}'):5601"
    echo "  Elasticsearch: https://$(hostname -I | awk '{print $1}'):9200"
    echo "  Logstash Beats input: $(hostname -I | awk '{print $1}'):5044"
    echo ""
    echo "Credentials:"
    echo "  Username: elastic"
    echo "  Password: $ELASTIC_PASSWORD"
    echo ""
    echo "Important files:"
    echo "  Elasticsearch config: /etc/elasticsearch/elasticsearch.yml"
    echo "  Kibana config: /etc/kibana/kibana.yml"
    echo "  Logstash config: /etc/logstash/conf.d/"
    echo ""
    print_warning "Please save the elastic password in a secure location!"
}

# Main function
main() {
    parse_args "$@"
    check_root
    detect_distro
    
    $PKG_UPDATE
    
    install_java
    add_elastic_repo
    install_elasticsearch
    install_kibana
    install_logstash
    configure_firewall
    verify_installation
    print_final_info
    
    print_success "ELK Stack installation completed successfully!"
}

main "$@"