elasticsearch

# name of the cluster - all nodes in the cluster must have same cluster name
cluster.name: 'qa-elk'

# use the private IP of the node here
network.host: "0"

path:
    data: /var/lib/elasticsearch
    logs: /var/log/elasticsearch

######## Start Search Guard Demo Configuration ########
# WARNING: revise all the lines below before you go into production
searchguard.ssl.transport.pemcert_filepath: esnode.pem
searchguard.ssl.transport.pemkey_filepath: esnode-key.pem
searchguard.ssl.transport.pemtrustedcas_filepath: root-ca.pem
searchguard.ssl.transport.enforce_hostname_verification: false
searchguard.ssl.http.enabled: true
searchguard.ssl.http.pemcert_filepath: esnode.pem
searchguard.ssl.http.pemkey_filepath: esnode-key.pem
searchguard.ssl.http.pemtrustedcas_filepath: root-ca.pem
searchguard.allow_unsafe_democertificates: true
searchguard.authcz.admin_dn:
  - CN=kirk,OU=client,O=client,L=test, C=de

searchguard.audit.type: internal_elasticsearch
searchguard.enable_snapshot_restore_privilege: true
searchguard.check_snapshot_restore_write_privileges: true
searchguard.restapi.roles_enabled: ["sg_all_access"]
discovery.zen.minimum_master_nodes: 1
node.max_local_storage_nodes: 3
######## End Search Guard Demo Configuration ########

filebeat.yml

filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/*
  fields:
    type: system
  exclude_files: ['\.gz$', 'btmp*', 'wtmp*']
  close_inactive: 1h

- input_type: log
  paths:
    - /opt/app1/logs/*.log
  fields:
    type: app1
  exclude_files: ['\.gz$']
  close_inactive: 5h
  
output.logstash:
  hosts: ["our-logstash.server:5043"]

kibana

elasticsearch.url: http://our-elk.server:9200
server.host: 0.0.0.0
logging.dest: /var/log/kibana.log
logging.silent: false
elasticsearch.username: "username"
elasticsearch.password: "password"
elasticsearch.ssl.verificationMode: none
searchguard.basicauth.enabled: true

logstash.conf

input {
	beats {
		port => "5043"
	}
}

output {
    elasticsearch {
        hosts => [ "our-elk.server:9200" ]
	      manage_template => false
	      index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
	      document_type => "%{[@metadata][type]}"
    }
}