To centralize Linux logs, use one Linux VPS as the control point for Elasticsearch, Kibana, and Logstash, then install Filebeat on every server that produces logs. Filebeat forwards lines to Logstash; Logstash parses and enriches them; Elasticsearch stores and searches the resulting events; Kibana lets you explore and visualize them.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The reliable build order is Elasticsearch, Kibana, Logstash, then Filebeat or Elastic Agent. Keep every Elastic Stack component on the same version line, restrict the VPS firewall to trusted senders, and verify that Elasticsearch is receiving events before you troubleshoot Kibana. This guide shows the architecture, installation sequence, pipeline configuration, security controls, verification checks, sizing decisions, and common failure fixes.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat the centralized logging architecture does
A centralized design separates collection, processing, storage, and presentation so that an incident on one application server does not erase the evidence you need. The central VPS runs three services:
- Elasticsearch stores indexed log events and provides the search API.
- Logstash accepts events, parses fields, adds context, and routes them to Elasticsearch.
- Kibana queries Elasticsearch and provides Discover, dashboards, alerts, and management screens.
Each monitored Linux server runs Filebeat, a lightweight collector that reads files or other configured inputs and forwards events to Logstash. The network path is therefore:
#1 Best Overall
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
Linux log file or syslog source → Filebeat → Logstash (inputs → filters → outputs) → Elasticsearch → Kibana
Elastic describes the Logstash event processing pipeline as three stages: “inputs → filters → outputs.” Keep that separation visible in your configuration. It makes a pipeline easier to test and lets you change parsing without changing the collection agent on every source host.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Plan the deployment before installing packages
Choose the central VPS role
The VPS must have a stable private or public address reachable by every source server, persistent storage for Elasticsearch data, and enough CPU, memory, and disk throughput for your ingest rate and retention period. A single VPS is appropriate for a small, low-volume deployment when you size it conservatively. It is not a universal performance recipe: there is no authoritative RAM or events-per-second number that applies to every workload.
Write down these values before deployment:
- How many source servers will send events.
- Approximate log volume per day, including bursts during deployments or incidents.
- How many days of searchable retention you need.
- Whether logs must remain in a particular country or region.
- Which administrators need Kibana and Elasticsearch access.
If Logstash filters become CPU- or memory-intensive, place Logstash on its own host. High-volume retention, redundancy, or multi-node Elasticsearch also calls for separate hosts rather than continually enlarging one VPS.
Keep versions aligned
Elastic requires the products in a deployment to use the same version. Pin the repository or package versions consistently instead of allowing one component to advance independently. For a new installation, select one supported 9.x release line and use that same line for Elasticsearch, Kibana, Logstash, and Filebeat. Apply upgrades as a coordinated change: upgrade the repository definitions or package pins, then validate the pipeline before removing the previous version.
Rank #2
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Prepare DNS, time, and firewall rules
Give the central VPS a DNS name if possible, and use UTC for server clocks. Consistent time makes cross-host investigations practical; the date in an index such as logstash-YYYY.MM.DD is based on UTC in Elastic’s example.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Keep the firewall closed by default. Permit the Beats ingestion port only from the IP ranges of trusted source servers. The common Logstash example uses TCP port 5044; you may choose another port, but the Filebeat output, Logstash input, and firewall rule must match. Do not expose Elasticsearch’s transport or HTTP interfaces or Kibana’s administration surface to the whole internet. Use the authentication and TLS controls supplied by your Elastic deployment, and put administrative access behind a VPN or an allowlist where practical.
Install the Elastic Stack in the supported order
Install in this order: Elasticsearch, Kibana, Logstash, then Filebeat or Elastic Agent. Elastic publishes DEB, RPM, archive, and Docker distributions. Package installations are normally managed as system services, which simplifies startup, restart, and boot persistence.
Debian or Ubuntu central VPS
- Import Elastic’s signing key using the current command from Elastic’s Debian installation documentation.
- Add the Elastic 9.x APT repository, pinning the same release line you will use for every component.
- Refresh package metadata:
sudo apt-get update - Install Elasticsearch, then initialize and start it according to the release’s security setup instructions.
- Install Kibana and configure it to connect to the local Elasticsearch service.
- Install Logstash:
sudo apt-get install logstash - Enable the services so they start after reboot, and check each service’s status before moving to the next component.
Repository signing-key commands and security enrollment steps change between Elastic releases. Copy those release-specific lines from the official documentation rather than reusing an older key URL or repository stanza.
RPM-based distributions
- Import Elastic’s signing key from the current RPM installation instructions.
- Create a 9.x YUM repository definition, using the same version line selected for Elasticsearch, Kibana, Logstash, and Filebeat.
- Install Elasticsearch and Kibana first, then Logstash with:
sudo yum install logstash - Enable and start the services, then inspect their status and logs before configuring clients.
The exact repository file and key command depend on the distribution and Elastic release. Do not mix a DEB repository with RPM packages or combine packages from different major versions.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
Install Filebeat on each source server
Repeat the package-repository process on every Linux server being monitored, then install Filebeat at the same version as the central stack. Filebeat should run on the source host, not only on the central VPS, because its registry records how far it has read each file.
Configure Logstash as inputs, filters, and outputs
Create a dedicated pipeline configuration in Logstash’s pipeline configuration directory. The following pattern is the essential shape; adjust credentials, certificates, index naming, and parsing rules to your environment.
input {
beats {
port => 5044
}
}
filter {
# Add Grok, date, JSON, mutate, or enrichment rules here.
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash-%{+YYYY.MM.dd}"
}
}Use localhost:9200 when Elasticsearch is on the same VPS. For a remote cluster, replace it with the cluster endpoint and configure the required authentication and TLS settings. The Beats input port must be reachable from each source server but should not be open to arbitrary internet clients.
Start with a pass-through pipeline
First prove transport and indexing with minimal filtering. Once events arrive, add one parser at a time. A Grok pattern can turn an unstructured web or application line into fields such as client address, request path, status code, and response time. A date filter should convert the event’s embedded timestamp into the canonical event time so searches and visualizations use the log’s occurrence time rather than the arrival time.
Keep parsing failures visible. Route events that do not match a pattern to a diagnostic tag or a separate index instead of silently dropping them. During development, send a copy to a temporary output or inspect Logstash’s own logs, then remove verbose debugging after the pattern is stable.
Rank #4
- Entry-level NAS Home Storage: The UGREEN NAS DH4300 Plus is an entry-level 4-bay NAS that's ideal for home media and vast private storage you can access from anywhere and also supports Docker but not virtual machines. You can record, store, share happy moment with your families and friends, which is intuitive for users moving from cloud storage, or external drives to create your own private cloud, access files from any device.
- Smart Photo Backup & AI Album: Automatically back up photos and videos from your phone in real time and keep growing family memories organized with AI-powered photo albums. Semantic search, custom learning, and recognition of people, objects, pets, and similar photos help you quickly find the moments you want. Duplicate photo removal also helps keep your library organized—ideal for families and users with large photo collections.
- User-Friendly App & Easy Setup: Connect quickly via NFC, set up simply and share files fast on Windows, macOS, Android, iOS, web browsers, and smart TVs. You can access data remotely from any of your mixed devices. What's more, UGREEN NAS enclosure comes with beginner-friendly user manual and video instructions to ensure you can easily take full advantage of its features.
- More Cost-effective Storage Solution: Unlike cloud storage with recurring monthly fees, A UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $629.99 for a NAS, while for cloud storage, you need to pay $719.88 per year, $1,439.76 for 2 years, $2,159.64 for 3 years, $7,198.80 for 10 years. You will save $6,568.81 over 10 years with UGREEN NAS! *NAS cost based on DH4300 Plus + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Your Data, You Control：No third-party clouds, no hidden access, UGREEN NAS provides a more secure and private data storage solution. It stores data locally on your private hard drives and does automatic backups. Thus, you can keep full control over it. The advanced encryption is TRUSTe certified in the United States and is awarded the first (and only) ETSI EN 303 645 certification mark for NAS products by TÜV SÜD Group.
Configure Filebeat to send server logs to Logstash
On every monitored server, configure Filebeat inputs for the actual paths used by the operating system, web server, database, or application. A basic file input has the following shape:
filebeat.inputs:
- type: filestream
id: linux-system-logs
paths:
- /var/log/*.log
- /var/log/**/*.log
output.logstash:
hosts: ["logs.example.net:5044"]Use the current Filebeat input syntax for your installed version and narrow the paths to files that really exist. Avoid collecting the same file through two inputs, which creates duplicate events. Ensure the Filebeat service account can read the files; many distributions require membership in a log-reading group or an explicit ACL.
Enable modules for common services
Filebeat modules provide prebuilt inputs, field mappings, and dashboards for common Linux, web, and service logs when a module is available for that product. Enable only the modules you need, confirm their configured paths, and keep the module version aligned with Filebeat. If a module expects a distribution-specific path that your service does not use, edit the input before starting collection.
Protect the Filebeat-to-Logstash connection
Use TLS for traffic crossing an untrusted network and configure Logstash to require client authentication when your security model calls for it. Store credentials and private keys with permissions that prevent ordinary users from reading them. Restrict the firewall on port 5044 to source addresses, and use a private network or VPN instead of publishing the ingestion endpoint whenever your hosting environment supports one.
Start services and verify the complete path
Do not begin with Kibana dashboards. Confirm each layer in order so a missing event has a small search space.
Best Value
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
- Check Elasticsearch: verify that the service is running, authenticated requests succeed, and the node has free disk space.
- Check Kibana: verify it can reach Elasticsearch and that its status page reports a healthy connection.
- Check Logstash: start the pipeline and inspect its service log for configuration, certificate, or port-binding errors.
- Check Filebeat: start it on one source host first and inspect its service log for permission, registry, or connection errors.
- Generate a known test line: append a unique timestamped line to a monitored file or trigger a harmless application event.
- Confirm Filebeat progress: verify that the registry advances past the test line and that no harvester reports a read error.
- Confirm Logstash receipt: look for accepted Beats connections and successful filter/output activity.
- Query Elasticsearch directly: search the expected daily index, for example
logstash-2026.10.15for an event whose UTC date is October 15, 2026. Use the Elasticsearch search API and list indexes with_cat/indiceswhen you need to discover the actual name. - Open Kibana Discover: create or select a data view matching the index name, choose the correct time field, set a time range covering the test, and search for the unique message.
Record timestamps in UTC while comparing the source line, Filebeat event, Logstash output, Elasticsearch document, and Kibana result. A local-time assumption is a common reason an otherwise healthy event appears to be missing.
Create a useful Kibana view
In Kibana, open Stack Management → Data Views and create a data view for the index pattern you actually use, such as logstash-*. Select the event timestamp field if your pipeline sets one. Then open Discover, choose the data view, and start with a narrow time range and a distinctive host or message term.
Add fields that answer operational questions: host name, service, severity, HTTP status, source address, and parsed message. Save searches for recurring investigations, then build visualizations only after the fields have the correct types. A status field indexed as text will not aggregate like a numeric field, and an incorrectly parsed timestamp will place events outside the expected time window.
Size retention, storage, and processing conservatively
Elasticsearch storage grows with event volume, indexed fields, replicas, and retention. Estimate daily primary data, add room for index overhead and bursts, and keep operational free space rather than filling the volume to its nominal capacity. Decide whether old data should be deleted, moved to cheaper storage, or exported before it reaches the retention limit.
CPU and memory demand rises with Grok complexity, JSON decoding, enrichment, and concurrent sources. A resource-heavy Logstash deployment may belong on its own host. Likewise, multi-node Elasticsearch is the appropriate direction when you need higher availability, larger searchable history, or failure tolerance; simply adding more Filebeat clients to one small VPS does not provide those properties.
Recommended Free Tools
Monitor disk usage, JVM health, indexing errors, pipeline latency, rejected connections, and Filebeat backpressure. Test a restore of any backup rather than assuming that a snapshot or copied volume is usable. Document who receives alerts when ingestion stops and how to temporarily reduce verbosity during an incident.
Choose between a self-managed VPS and a managed deployment
| Decision area | Self-managed Linux VPS | Managed Elastic or cloud deployment |
|---|---|---|
| Monthly cost | VPS, storage, transfer, and backup charges are billed directly; cost varies with capacity and retention. | Provider pricing covers the service and its resources; the bill varies by ingest, storage, retention, and selected service tier. |
| Operational workload | You patch packages, maintain repositories, renew certificates, tune JVM and disk usage, back up data, and respond to incidents. | The provider reduces host maintenance and may automate upgrades, backups, and scaling, but you still manage data, access, pipelines, and service limits. |
| Scaling | You resize the VPS or add hosts and must plan migrations and cluster topology. | Scaling controls are easier to access, subject to the provider’s capacity, architecture, and pricing limits. |
| Security responsibility | You own firewall rules, TLS, authentication, operating-system hardening, patching, and exposure of every endpoint. | The provider secures the managed control plane and infrastructure; you remain responsible for identities, permissions, network paths, and configuration. |
| Retention control | You choose index lifecycle, disk layout, backups, and deletion schedules, constrained by your storage budget. | You use the provider’s retention and snapshot features, with limits and charges defined by the service. |
| Geographic placement | You select the VPS region and can keep data on hosts you control. | You select from the provider’s available regions and must confirm where primary data, replicas, and backups reside. |
A self-managed VPS gives maximum control over package versions, network placement, and retention, but it makes patching, backups, TLS, capacity planning, and incident response your responsibility. A managed Elastic or cloud deployment reduces host administration and can scale more easily, while trading away some infrastructure control for provider pricing and service-specific limits.
Troubleshoot by locating the first broken boundary
Filebeat is running but no events arrive
- Check that the configured path exists and that new lines are being appended after Filebeat starts.
- Check read permissions and the Filebeat service log for harvester errors.
- Confirm the central hostname resolves from the source server and that the firewall allows the configured port.
- Verify that Filebeat is sending to Logstash, not directly to an unintended Elasticsearch output.
Logstash reports connection or pipeline errors
- Confirm that the Beats input and Filebeat use the same port.
- Check whether another process already occupies that port.
- Validate certificate paths, credentials, and trust settings when TLS is enabled.
- Check Logstash configuration syntax and temporarily remove the newest filter to isolate a parsing mistake.
Elasticsearch has no expected index
- Use
_cat/indicesto see whether the index name differs from your assumption. - Inspect Logstash output errors for authentication, TLS, rejected writes, or an unreachable endpoint.
- Check disk watermarks and cluster health; Elasticsearch can stop accepting writes when storage is critically full.
- Search the UTC date that matches the event rather than the browser’s local date.
Events are indexed but absent in Kibana
- Refresh or recreate the data view after the first matching index exists.
- Set the time field and widen the time range.
- Search the exact host name or unique test message before relying on a dashboard visualization.
- Inspect the document in Discover to confirm that the timestamp and field types are what the visualization expects.
Operate the stack safely after launch
- Keep Elasticsearch, Kibana, Logstash, and Filebeat on the same version line during upgrades.
- Apply security updates promptly, but stage version changes and test ingestion with one source host first.
- Review firewall rules whenever a source server is added or removed.
- Rotate credentials and certificates before expiry and remove access for departed administrators.
- Test backups and restores, including the Kibana objects and any custom pipeline files.
- Review retention against actual disk growth rather than relying on the original estimate.
- Keep a documented test event and repeat the end-to-end check after upgrades, network changes, or certificate renewal.
With this arrangement, you can forward server logs to one controlled Logstash endpoint, search structured events in Elasticsearch, and view Linux server logs in Kibana without logging into every source host. The design remains maintainable when you treat version consistency, least-privilege networking, UTC timestamps, and measured capacity as operational requirements rather than optional refinements.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
