The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Run Elasticsearch and Kibana on one secured Linux VPS, use Logstash as the processing and routing layer, and install Filebeat on every server that produces logs. Filebeat sends lines to Logstash, Logstash parses and enriches them, Elasticsearch indexes them, and Kibana lets you search and visualize the resulting events. The dependable deployment order is Elasticsearch, Kibana, Logstash, then Filebeat or Elastic Agent, with every Elastic component kept on the same version line.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the centralized logging architecture does
A centralized setup removes the need to log in to each Linux machine separately. Every source server keeps producing its normal application, web, authentication, and system logs, but a lightweight collector forwards copies to one searchable location. The central VPS becomes the place where operators investigate incidents, compare hosts, and build dashboards.
As an Amazon Associate I earn from qualifying purchases.
| Component | Runs where | Responsibility |
|---|---|---|
| Filebeat | Every monitored Linux server | Reads configured files or other supported inputs, tracks its reading position, and forwards events. |
| Logstash | Central VPS, or a separate processing host at larger scale | Accepts Beats connections, parses text with Grok and other filters, enriches events, and routes them. |
| Elasticsearch | Central VPS or a managed deployment | Indexes, stores, and searches the structured events. |
| Kibana | Central VPS or a managed deployment | Provides Discover, dashboards, visualizations, and management interfaces for the indexed data. |
The data path is therefore:
- A log line is written on a source host.
- Filebeat reads it and records its registry position so a restart does not normally resend everything.
- Filebeat opens a Beats connection to Logstash, normally on port
5044. - Logstash applies the selected input, filter, and output stages.
- Elasticsearch creates or updates the destination index.
- Kibana queries that index and presents the events in Discover or a dashboard.
Elastic describes the Logstash design in one sentence: “The Logstash event processing pipeline has three stages: inputs → filters → outputs.” Treat that as the organizing rule for every pipeline you create.
Decide whether one VPS is appropriate
A single VPS is a sensible starting point when the number of source servers, event rate, parsing complexity, and retention period are modest. It is not automatically safe to copy a sizing number from another deployment: the available guidance does not establish an authoritative RAM, CPU, storage, or events-per-second benchmark. Size from the workload you can observe.
#1 Best Overall
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
Workload questions to answer first
- How many source servers will send events?
- Which files are collected, and how quickly do they grow during normal traffic and incidents?
- How much history must remain searchable?
- Will Logstash only pass through fields, or will it run expensive Grok, JSON, GeoIP, or enrichment filters?
- How much headroom is required for a traffic spike, a failed source that reconnects, or a temporary indexing slowdown?
Estimate daily ingest from actual file growth, then add the storage used by Elasticsearch indexes, replicas if you use them, operating-system space, logs, snapshots, and free space for merges. Recheck the estimate after enabling a busy web or application host; a quiet test day is not a capacity plan.
Self-managed versus managed deployment
| Decision area | Self-managed Linux VPS | Managed Elastic or cloud deployment |
|---|---|---|
| Monthly cost | VPS, storage, backups, and any extra hosts; the bill is predictable only after you measure usage. | Provider charges for compute, storage, data transfer, and service features; pricing and limits are provider-specific. |
| Operations | You patch packages, rotate certificates, configure backups, tune retention, and respond to failures. | The provider reduces host maintenance and generally makes resizing easier, while you still manage data, access, and pipeline design. |
| Scaling | Resize the VPS or add dedicated Logstash and Elasticsearch hosts yourself. | Use the service’s scaling controls, subject to its supported tiers and limits. |
| Security responsibility | You own firewall rules, TLS, authentication, operating-system hardening, and update timing. | The provider operates part of the platform, but your users, API keys, network policy, and data configuration remain your responsibility. |
| Retention control | Full control over index lifecycle, disk layout, snapshots, and deletion timing. | Retention is configurable within the service’s storage and policy limits. |
| Geographic placement | Choose the VPS region and any replica or backup locations. | Choose among the provider’s available regions and understand where primary and backup data reside. |
Elastic documentation identifies Elastic Cloud Hosted as an available managed path. Choose it when reducing host maintenance is worth giving up some infrastructure-level control. Choose a VPS when package versions, network placement, retention mechanics, and operating-system access matter more than hands-off scaling.
Prepare versions, names, and network boundaries
Keep Elasticsearch, Kibana, Logstash, and Filebeat on the same Elastic version line. If the central stack is on the 9.x line, use the matching 9.x repository or packages for every component instead of allowing one machine to silently install a different major version. Pin or otherwise control repository versions during both initial installation and upgrades, and plan upgrades as a coordinated change.
Give the central VPS a stable private address or DNS name reachable from the source servers. Decide which interface accepts Beats traffic and which interface is used for administration. The firewall should expose only the ingestion port to trusted senders. Do not make Elasticsearch’s API or Kibana’s administrative interface broadly reachable from the public internet; protect them with the deployment’s authentication and TLS controls and restrict access to operator networks.
Write down the source-host list, the expected log paths, the index naming convention, the retention target, the backup destination, and who can administer Kibana before installing packages. These decisions prevent a working proof of concept from becoming an unowned production service.
Install the central stack on Debian or Ubuntu
Elastic publishes DEB, RPM, archive, and Docker distributions. The following sequence assumes a DEB-based VPS and a configured 9.x APT repository. Import Elastic’s signing key and add the official 9.x repository using the current instructions for your distribution before installing packages; the repository setup is deliberately kept separate from the package commands so you can pin the exact minor version you have approved.
Rank #2
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
- Refresh package metadata:
sudo apt-get update. - Install the three central services:
sudo apt-get install elasticsearch kibana logstash. - Enable and start Elasticsearch, then Kibana and Logstash with your distribution’s service manager. For systemd, the pattern is
sudo systemctl enable --now elasticsearch, followed by the equivalent commands forkibanaandlogstash. - Complete the authentication, TLS, and enrollment steps printed or documented for the installed release. Do not disable security merely to make an initial connection work.
Install Filebeat separately on each Linux source host, not only on the central VPS. After adding the same 9.x repository and key there, run sudo apt-get update and sudo apt-get install filebeat. Keep the source package on the same version line as the central services.
Install on an RPM-based Linux server
For an RPM-based source or central host, import the signing key and create the official 9.x YUM repository definition before installing. Then use:
sudo yum install elasticsearch kibana logstashon the central host.sudo yum install filebeaton each source host.- Enable the corresponding services with systemd, for example
sudo systemctl enable --now logstash.
Use the package’s service unit rather than running a foreground process in a shell. Package-managed services provide predictable startup, log locations, and upgrade behavior. Confirm the installed versions on every host before opening the ingestion port.
Configure Elasticsearch and Kibana before ingesting data
Elasticsearch must be healthy before Logstash can write events. Confirm that its node is running and that its authentication and TLS settings are the ones you intend to keep. If Elasticsearch and Logstash share the VPS, the output can target the local endpoint; if Elasticsearch is remote, use the cluster endpoint instead. In either case, configure the credentials, trusted certificate authority, and least-privilege permissions through the security mechanism supported by your installed release.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Kibana should point to that same Elasticsearch deployment. Restrict its listener to the administration network or place it behind an authenticated reverse proxy. A user who can view logs may see passwords, tokens, personal data, or internal hostnames, so create roles deliberately rather than handing every operator an administrator account.
Do not create a Kibana data view until an index exists. Discover cannot display events that Elasticsearch has not indexed, and a correctly configured dashboard cannot repair a broken ingestion path.
Rank #3
- Your Personal Streaming Server - Build your own Netflix-style media library and stream 4K movies, shows and photos to any device without monthly fees
- Create Your Own Cloud - Store your entire photo, video and music collection; access from anywhere with fast 282 MB/s transfer speeds
- Creator-Grade Backup Solution - Protect your irreplaceable content with automated backups to cloud services, external drives and remote NAS
- Multi-Layered Data Protection - Combine RAID redundancy, automated backups and snapshot technology to prevent data loss from any cause
- Smart Home Surveillance - Support up to 30 IP cameras with AI detection, instant alerts and secure remote monitoring
Create the Logstash pipeline
Create a pipeline configuration in the directory used by your package installation. Start with one clearly named file and one pipeline so that errors are easy to isolate. The essential pattern is:
input {
beats {
port => 5044
}
}
filter {
if [message] {
grok {
match => { "message" => "%{SYSLOGBASE}" }
tag_on_failure => ["_grokparsefailure"]
}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash-%{+YYYY.MM.dd}"
}
}This is a starting pattern, not a universal parser. SYSLOGBASE is appropriate only for messages that resemble the relevant syslog structure. Web access logs, JSON application logs, kernel messages, and multiline stack traces need formats and filters that match their actual content. Preserve the original message while adding parsed fields so a failed parse can still be investigated.
Recommended Free Tools
The daily index expression produces names in the logstash-YYYY.MM.DD style described in Elastic’s examples. If Elasticsearch is not on the same VPS, replace localhost:9200 with the cluster endpoint and configure the required TLS and authentication options. Never expose port 5044 to every internet address; allow only the source networks you have identified.
Validate the configuration before restarting the service using the validation command supplied by your installed Logstash package, then inspect the service journal if validation or startup fails. A syntax error prevents the pipeline from accepting any events, so check braces, quotation marks, plugin names, and field references first.
Configure Filebeat on each source server
Filebeat is designed to be lightweight and resource-friendly. Configure it on every machine whose logs you want to centralize, and point its output to the central Logstash host rather than directly to Elasticsearch when Logstash is your processing layer.
Edit the Filebeat configuration on the source host. Enable the input paths you actually need and disable broad globs that would collect private keys, temporary files, or the same log twice. A minimal shape is:
Rank #4
- Entry-level NAS Home Storage: The UGREEN NAS DH4300 Plus is an entry-level 4-bay NAS that's ideal for home media and vast private storage you can access from anywhere and also supports Docker but not virtual machines. You can record, store, share happy moment with your families and friends, which is intuitive for users moving from cloud storage, or external drives to create your own private cloud, access files from any device.
- Smart Photo Backup & AI Album: Automatically back up photos and videos from your phone in real time and keep growing family memories organized with AI-powered photo albums. Semantic search, custom learning, and recognition of people, objects, pets, and similar photos help you quickly find the moments you want. Duplicate photo removal also helps keep your library organized—ideal for families and users with large photo collections.
- User-Friendly App & Easy Setup: Connect quickly via NFC, set up simply and share files fast on Windows, macOS, Android, iOS, web browsers, and smart TVs. You can access data remotely from any of your mixed devices. What's more, UGREEN NAS enclosure comes with beginner-friendly user manual and video instructions to ensure you can easily take full advantage of its features.
- More Cost-effective Storage Solution: Unlike cloud storage with recurring monthly fees, A UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $629.99 for a NAS, while for cloud storage, you need to pay $719.88 per year, $1,439.76 for 2 years, $2,159.64 for 3 years, $7,198.80 for 10 years. You will save $6,568.81 over 10 years with UGREEN NAS! *NAS cost based on DH4300 Plus + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Your Data, You Control：No third-party clouds, no hidden access, UGREEN NAS provides a more secure and private data storage solution. It stores data locally on your private hard drives and does automatic backups. Thus, you can keep full control over it. The advanced encryption is TRUSTe certified in the United States and is awarded the first (and only) ETSI EN 303 645 certification mark for NAS products by TÜV SÜD Group.
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/*.log
output.logstash:
hosts: ["central-logstash.example.internal:5044"]Replace the example hostname with the stable private name or address of your VPS. The example path is intentionally broad only to show the structure; select explicit paths for your distribution and services. If your logs are JSON, multiline, or rotated in a nonstandard way, configure the corresponding Filebeat options so one logical event is not split into misleading records.
Enable the relevant Filebeat modules when they are available for the Linux distribution, web server, database, or service you monitor. Modules provide tested input and field conventions for common sources, but review their paths and processors before enabling them on a host with customized logging.
Configure TLS for the Beats connection and verify the central certificate from each source. Use an identity with only the permissions needed to submit events. Then enable and start Filebeat with systemd. Its registry records progress; do not delete that registry during routine troubleshooting unless you intentionally accept re-reading data.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSecure the path from source to Kibana
- Firewall: permit TCP 5044 only from known source addresses or private network ranges. Permit Elasticsearch and Kibana administration only from operator networks or the required internal services.
- TLS: encrypt Filebeat-to-Logstash and Logstash-to-Elasticsearch traffic, especially across hosts or networks you do not fully control. Install and rotate certificates before they expire.
- Authentication: use the authentication and authorization controls supplied with the deployment. Separate ingestion identities from human administrator accounts.
- Data minimization: exclude secrets, private keys, session tokens, and unnecessary personal data at the source or in a carefully tested filter.
- Time: synchronize clocks on every host. Store and compare timestamps in UTC when tracing an event across the pipeline.
A firewall rule that allows Logstash to receive events does not make Elasticsearch safe to expose. The ingestion listener and the search/API listener have different audiences and should have different network policies.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Start services and verify the complete path
Test from a known source host and follow the event through every boundary. Start or restart services only after their configuration validates, then perform these checks in order:
- Source file: append a distinctive, harmless test line to a monitored log or trigger a normal application event. Record the source hostname and the UTC time.
- Filebeat: inspect its service status and logs for registry progress, connection attempts, certificate errors, or back-pressure. A source that cannot resolve the central hostname has not reached Logstash.
- Logstash: confirm that the Beats input is listening on 5044 and that the pipeline is running. Look for connection acceptance, parse failures, rejected events, and output errors.
- Elasticsearch: query the authenticated search API for the daily
logstash-YYYY.MM.DDindex and use the_cat/indicesAPI to list available indexes. The index date in this example is based on UTC. - Kibana: open the management area, create or select a data view matching the Logstash index name, choose the timestamp field if one exists, and open Discover.
In Kibana, use a time range that includes the recorded UTC test time and filter by the unique message or source hostname. If the event appears in Elasticsearch but not Discover, investigate the data view pattern, time field, and selected time range rather than restarting Filebeat.
Best Value
- Value NAS with RAID for centralized storage and backup for all your devices. Check out the LS 700 for enhanced features, cloud capabilities, macOS 26, and up to 7x faster performance than the LS 200.
- Connect the LinkStation to your router and enjoy shared network storage for your devices. The NAS is compatible with Windows and macOS*, and Buffalo's US-based support is on-hand 24/7 for installation walkthroughs. *Only for macOS 15 (Sequoia) and earlier. For macOS 26, check out our LS 700 series.
- Subscription-Free Personal Cloud – Store, back up, and manage all your videos, music, and photos and access them anytime without paying any monthly fees.
- Storage Purpose-Built for Data Security – A NAS designed to keep your data safe, the LS200 features a closed system to reduce vulnerabilities from 3rd party apps and SSL encryption for secure file transfers.
- Back Up Multiple Computers & Devices – NAS Navigator management utility and PC backup software included. NAS Navigator 2 for macOS 15 and earlier. You can set up automated backups of data on your computers.
For a direct API check, run an authenticated request against the relevant daily index’s search endpoint and inspect the returned hits. Search first for the exact test string, then for the host field and timestamp. This separates an indexing problem from a visualization problem.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot by locating the first broken hop
| Symptom | Likely boundary | Checks and fixes |
|---|---|---|
| Filebeat reports connection refused or timeout | Source to Logstash network | Confirm DNS or routing, the VPS firewall, the Logstash listener address, and that TCP 5044 is open only to the source network. |
| Filebeat connects but no index appears | Logstash pipeline or output | Check pipeline validation, service logs, plugin errors, Elasticsearch reachability, credentials, TLS trust, and disk space. |
Events arrive with _grokparsefailure |
Filter stage | Inspect the original message, adjust the Grok pattern to the real log format, and keep the failure tag until parsing is proven. |
| One event becomes several records | Filebeat input | Review multiline settings and rotation behavior; configure the input to join stack traces or other multi-line records before transmission. |
| Elasticsearch contains events but Discover is empty | Kibana data view or time filter | Match the data view to the actual index name, select the correct timestamp field, widen the UTC time range, and refresh the field list. |
| Only recent events are visible | Retention or index selection | Check which daily indexes still exist, the deletion policy, available disk, and whether the data view includes all intended index names. |
| Duplicate events appear after recovery | Registry or replay behavior | Check whether the Filebeat registry was removed or restored from an old backup. Preserve the registry during normal repairs and deduplicate only with a deliberate policy. |
Always identify the first hop that fails. Changing a Kibana dashboard cannot fix an Elasticsearch output error, and changing a Grok pattern cannot fix a blocked firewall.
Retention, backups, and day-two operations
Retention is a storage decision, not merely a Kibana setting. Define how many days of searchable data you need, what must be archived for compliance, and when old indexes may be deleted. Monitor disk consumption, JVM pressure, CPU, load, indexing latency, Logstash queue growth, and Filebeat connection errors. Alert before the filesystem reaches the point where Elasticsearch cannot merge segments or Logstash cannot write its own logs.
Back up the data and the configuration separately. A snapshot or other Elasticsearch-supported backup protects indexed data; copies of Logstash pipelines, Filebeat configuration, certificates, role definitions, and version information let you rebuild the service. Test restoration on a separate environment instead of assuming that a successful backup job guarantees a usable recovery.
Apply operating-system and Elastic security updates on a schedule, but upgrade the components as a compatible set. Read the release notes for the exact 9.x versions you run, stage changes where possible, and keep a rollback plan for package and configuration changes. Record the current index naming, retention, firewall, and certificate settings so an incident responder can understand the deployment without guessing.
Know when to move beyond one VPS
Separate roles when one host can no longer provide safe headroom. A resource-heavy Logstash deployment may deserve its own host, while Elasticsearch storage and query workloads may require dedicated nodes or a multi-node design. Elastic documentation also describes Docker Compose and multi-node approaches for larger deployments.
- Add a dedicated Logstash host when parsing and enrichment consume resources needed by Elasticsearch or when source connections must remain available during Elasticsearch maintenance.
- Use multiple Elasticsearch nodes when storage capacity, query concurrency, resilience, or maintenance requirements exceed a single node’s practical limits.
- Separate Kibana when dashboards and user traffic compete with ingestion or when administrative access must be isolated.
- Adopt a managed deployment when operating-system patching, certificate rotation, and capacity changes are consuming more time than the logging workload justifies.
Scale from measurements: ingest volume, retention growth, queue depth, search latency, disk utilization, and recovery time. There is no responsible universal VPS size or event-rate promise without those measurements.
A repeatable operating checklist
- Confirm all Elastic components remain on one approved version line.
- Verify that only trusted sources can reach the Beats port.
- Check Filebeat, Logstash, and Elasticsearch service health after every reboot or upgrade.
- Send a known test event at a scheduled interval and alert when it disappears from Elasticsearch.
- Review parse-failure tags and unexpected field changes after application or operating-system upgrades.
- Check disk, JVM, CPU, queue, and index growth against the retention plan.
- Rotate certificates and credentials before expiry.
- Test backups and document restoration steps.
- Reassess whether Logstash or Elasticsearch should move to separate hosts as sources and retention grow.
With those controls in place, the VPS is more than a log collector: it is a controlled path from Linux files to structured, searchable events and an auditable place to investigate what happened across the fleet.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
