Kibana and Elastic Observability best practices

1. Foundation #

Installation and security.

Principles #

• Kibana and Elasticsearch on the same version, upgraded together.
• Stable encryption keys in kibana.yml (saved objects, reporting, security).
• Several Kibana instances behind a load balancer for high availability.
• SSO and named roles, elastic account reserved.

2. Usage #

Usable data.

Habits #

• A common field schema (ECS or OpenTelemetry semantic conventions).
• Data views per use case, not one giant * data view.
• Dashboards per space, versioned as ndjson and imported by CI.
• ES|QL for one-off analyses, Lens for lasting views.
• Reasonable time ranges: a dashboard over 90 days of raw logs is expensive at every opening.

3. Alerting #

Alerts that get handled.

Rules #

• Alerts on symptoms (error rate, latency, SLO) rather than on isolated log lines.
• Grouping by service and notification on status change.
• Maintenance windows for planned interventions.
• Regular review of rules that never fire or fire too often.

Reference diagram and quick check #

Checklist.

Checklist #

1. Aligned versions and encryption keys configured
2. Spaces and roles per team
3. Documented data views
4. Versioned dashboards
5. Alert rules with tested connectors
6. Kibana monitored