ELK Stack on Kubernetes: Nginx Log Collection and Visualization
Tags:
ElasticsearchKubernetesLog MonitoringFilebeatLogstashKibana
Created by:
Mahmood
3 uses
Collecting, parsing, storing, and visualizing application logs on Kubernetes requires wiring together multiple components in a specific sequence. This template deploys a complete ELK stack on Kubernetes for Nginx log monitoring, including Filebeat for log collection, Logstash for parsing, Elasticsearch for storage, and Kibana for visualization, all preconfigured as a working pipeline on Docker Desktop Kubernetes.
| Component | Type | Port | Role |
|---|---|---|---|
| Nginx | Deployment + Service | 80 | Application server generating logs at /var/log/nginx |
| Filebeat | Deployment | - | Log collection agent that forwards entries to Logstash |
| Logstash | Deployment + Service | 5044 | Log parsing and transformation pipeline |
| Elasticsearch | StatefulSet + Service | 9200 | Log storage and search backend |
| Kibana | Deployment + Service | 5601 | Log visualization and query interface |
| Ingress | Ingress | 80 | Routes external traffic to Nginx and Kibana at http://elk.local/ |
Nginx generates access and error logs at /var/log/nginx. Filebeat tails those log files and ships entries to Logstash over port 5044. Logstash parses and transforms the raw log data before forwarding it to Elasticsearch, which indexes and stores the logs for search. Kibana connects to Elasticsearch on port 9200 and provides a UI for querying and visualizing the indexed data. An Ingress exposes both Nginx and Kibana externally at http://elk.local/.
elk.local added to your /etc/hosts file pointing at 127.0.0.1127.0.0.1 elk.local to your /etc/hosts file before deploying.kubectl get pods -n <namespace> — Nginx, Filebeat, Logstash, Elasticsearch, and Kibana should all show Running.http://elk.local/ in your browser and confirm the Nginx default page loads, generating log entries.http://elk.local/ or via port-forward: kubectl port-forward svc/kibana 5601:5601 -n <namespace>, then open it at http://localhost:5601.kubectl logs <filebeat-pod> -n <namespace>.This template configures a complete ELK stack on Kubernetes for Nginx log collection, parsing, storage, and visualization using Filebeat, Logstash, Elasticsearch, and Kibana.