Would you like to learn how to install Auditbeat on Ubuntu Linux? In this tutorial, we are going to show you how to install the Auditbeat service on a computer running Ubuntu Linux and send the network information to an ElasticSearch server.

• Ubuntu 18
• Ubuntu 19
• ElasticSearch 7.6.2
• Kibana 7.6.2
• Auditbeat 7.6.2

In our example, The ElastiSearch server IP address is

Tutorial Auditbeat - Installation on Ubuntu Linux

Set a hostname using the command named hostnamectl.

Copy to Clipboard

Reboot the computer.

Copy to Clipboard

Download and install the Auditbeat package.

Copy to Clipboard

Edit the Auditbeat configuration file named auditbeat.yml.

Copy to Clipboard

Here is the original file, before our configuration.

Copy to Clipboard

Here is the file with our configuration.

Copy to Clipboard

In our example, we configured the Auditbeat service to send data to the ElasticSearch server

In our example, we configured the Auditbeat service to connect to the Kibana server

Use the following command to create the Auditbeat dashboards on the Kibana server.

Copy to Clipboard

Start the Auditbeat service.

Copy to Clipboard

Configure the Auditbeat service to start during boot time.

Copy to Clipboard

Congratulations! You have finished the Auditbeat installation on Ubuntu Linux.

Kibana - Accessing the Auditbeat Dashboard

Open your browser and enter the IP address of your Kibana server plus :5601.

In our example, the following URL was entered in the Browser:


The Kibana web interface should be presented

Kibana menus

On the Visualize and Explore Data area, select the Dashboard option.

Kibana dashboards

Search for dashboards named: Auditbeat

auditbeat dashboard

Select the desired Auditbeat dashboard.

auditbeat ubuntu

Congratulations! You are able to access the Auditbeat information on the Kibana server.