Administering Kibana

1. Spaces #

One Kibana, several teams.

Spaces #

A space groups a team's dashboards, data views, rules and other objects; it can hide unneeded features (for example Security for a product team).

curl -s -X POST localhost:5601/api/spaces/space -u elastic:$PASS -H 'kbn-xsrf: true' \
  -H 'Content-Type: application/json' \
  -d '{"id": "equipe-web", "name": "Équipe web", "disabledFeatures": ["siem", "securitySolutionCases"]}'

2. Roles and users #

Who sees what.

Roles #

A role combines Elasticsearch privileges (on indices: read, write) and Kibana privileges (per space and per feature: read or all).

curl -s -X PUT localhost:5601/api/security/role/lecteur_web -u elastic:$PASS -H 'kbn-xsrf: true' \
  -H 'Content-Type: application/json' -d '{
  "elasticsearch": { "indices": [ { "names": ["logs-*-web"], "privileges": ["read", "view_index_metadata"] } ] },
  "kibana": [ { "base": ["read"], "spaces": ["equipe-web"] } ] }'

# Utilisateur natif (en production : SSO SAML ou OIDC)
curl -s -X POST localhost:9200/_security/user/alice -u elastic:$PASS -H 'Content-Type: application/json' \
  -d '{"password": "un-mot-de-passe-solide", "roles": ["lecteur_web"], "full_name": "Alice"}'

Common mistake: The elastic account is a superuser: reserve it for installation, create named accounts and limited-privilege API keys for automation.

Document- and field-level security #

With the appropriate license, a role can restrict visible documents (filter query, for example organization.id: 42) and fields (hide user.email).

3. Monitoring Kibana #

The observability tool must be observed.

Points to track #

curl -s localhost:5601/api/status -u elastic:$PASS | jq '.status.overall'
curl -s localhost:5601/api/task_manager/_health -u elastic:$PASS | jq '.status'