Step-by-Step Deployment of the ELK Stack (Elasticsearch, Logstash, Kibana, Filebeat) on Kubernetes Using Docker and Helm

1. Deploy Elasticsearch

Pull the required Docker images:

docker pull docker.elastic.co/elasticsearch/elasticsearch:7.17.2

docker pull docker.elastic.co/kibana/kibana:7.17.2

docker pull docker.elastic.co/logstash/logstash:7.17.2

docker pull docker.elastic.co/beats/filebeat:7.17.2

Create a namespace for the ELK stack:

kubectl create namespace elk

Download the Elasticsearch Helm chart and inspect its files:

helm fetch elastic/elasticsearch

cd elasticsearch/

Modify values.yaml to reduce resource requirements (set master node count to 1 and disable high‑availability settings).

Install the chart:

helm install elasticsearch -f values.yaml elastic/elasticsearch --namespace elk

Verify the deployment:

kubectl describe pod elasticsearch-master-0 -n elk

kubectl get pods -n elk -l app=elasticsearch-master

2. Deploy Logstash

Download the Logstash chart and extract it:

helm fetch elastic/logstash

tar -zxvf logstash-7.17.3.tgz

Adjust values.yaml as needed, then install:

helm install logstash -f values.yaml elastic/logstash --namespace elk

Pull the Logstash Docker image and watch the pods:

docker pull docker.elastic.co/logstash/logstash:7.17.2

kubectl get pods --namespace=elk -l app=logstash-logstash -w

3. Deploy Filebeat

Fetch the Filebeat chart, extract it, and install:

helm fetch elastic/filebeat

tar -zxf filebeat-7.17.3.tgz

helm install filebeat elastic/filebeat --namespace elk

Pull the Filebeat Docker image and verify the pods:

docker pull docker.elastic.co/beats/filebeat:7.17.2

kubectl get pods --namespace=elk -l app=filebeat-filebeat

4. Deploy Kibana

Pull the Kibana image and download its Helm chart:

docker pull docker.elastic.co/kibana/kibana:7.17.2

helm fetch elastic/kibana

Edit values.yaml to change the service type to NodePort , then install:

helm install kibana01 -f values.yaml elastic/kibana --namespace elk

Check the Kibana pod status:

kubectl get pods --namespace=elk -o wide

After all components are running, the ELK stack is ready for log collection, processing, and visualization.