Kibana: role and installation

1. Kibana in the Elastic suite #

The stack's interface.

Role #

Kibana is the web interface of the Elastic suite: data exploration (Discover), visualizations and dashboards, business solutions (Observability, Security, Search), alerting and stack administration (Fleet, roles, indices).

Good to know: This course complements the Elasticsearch, Logstash and Beats courses: it focuses on using the data and on Elastic Observability.

2. Installing #

Three options.

start-local for learning #

curl -fsSL https://elastic.co/start-local | sh
# Elasticsearch : http://localhost:9200   Kibana : http://localhost:5601
cat elastic-start-local/.env | grep -E 'ES_LOCAL_PASSWORD|ES_LOCAL_API_KEY'

The official script starts Elasticsearch and Kibana with Docker, with security enabled and a trial license: ideal for labs. Do not use it in production.

Docker, explicitly #

docker network create elastic
docker run -d --name es --net elastic -p 9200:9200 -m 2GB \
  -e discovery.type=single-node -e ELASTIC_PASSWORD=changeme \
  docker.elastic.co/elasticsearch/elasticsearch:$VERSION
# Jeton d'inscription pour Kibana (valable 30 min)
docker exec es /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
docker run -d --name kibana --net elastic -p 5601:5601 docker.elastic.co/kibana/kibana:$VERSION
docker logs kibana | grep "Go to"      # lien avec le code de vérification

Good practice: Use the same version for Elasticsearch and Kibana (for example VERSION=9.1.0; check the latest version on elastic.co). Kibana refuses to start against a newer Elasticsearch.

kibana.yml in production #

server.host: 0.0.0.0
server.publicBaseUrl: https://kibana.example.org
elasticsearch.hosts: [https://es-1:9200, https://es-2:9200]
elasticsearch.serviceAccountToken: ${KIBANA_SA_TOKEN}
elasticsearch.ssl.certificateAuthorities: [/etc/kibana/certs/ca.crt]
xpack.encryptedSavedObjects.encryptionKey: ${ENCRYPTION_KEY}   # 32 caractères minimum
xpack.reporting.encryptionKey: ${REPORTING_KEY}
xpack.security.encryptionKey: ${SECURITY_KEY}

Common mistake: Without a stable xpack.encryptedSavedObjects.encryptionKey, alert rules and connectors cannot store their secrets and stop working after a restart.

3. Data views #

Telling Kibana what to query.

Creating a data view #

A data view (formerly index pattern) designates one or more indices, aliases or data streams (for example logs-*) and the time field. Discover, Lens and dashboards rely on it.

curl -s -X POST localhost:5601/api/data_views/data_view -u elastic:$PASS \
  -H 'kbn-xsrf: true' -H 'Content-Type: application/json' \
  -d '{"data_view": {"title": "logs-*", "name": "Tous les logs", "timeFieldName": "@timestamp"}}'

Good to know: Kibana APIs require the kbn-xsrf header for any request that changes something.