Elastic Cloud Kibana settings

If you are using OpenID Connect to secure your clusters, these settings are supported on Elastic Cloud Hosted.

xpack.security.authc.providers.oidc.<provider-name>.order

Specifies order of the OpenID Connect authentication provider in the authentication chain.

xpack.security.authc.providers.oidc.<provider-name>.realm

Specifies which OpenID Connect realm in Elasticsearch should be used.

xpack.security.authc.providers.oidc.<provider-name>.description

Specifies how OpenID Connect login should be titled in the Login Selector UI.

xpack.security.authc.oidc.realm

Specifies which OpenID Connect realm in Elasticsearch should be used.

To learn more, check configuring Kibana to use OpenID Connect.

If you want to allow anonymous authentication in Kibana, these settings are supported on Elastic Cloud Hosted. To learn more on how to enable anonymous access, check Enabling anonymous access and Configuring Kibana to use anonymous authentication.

xpack.security.sessionTimeout

Specifies the session duration in milliseconds. Allows a value between 15000 (15 seconds) and 86400000 (1 day). To learn more, check Security settings in Kibana. Deprecated in versions 7.6+ and removed in versions 8.0+.

xpack.security.authc.anonymous.*

Enables access for the anonymous user. In versions prior to 7.10 anonymous access is enabled by default, but you can add this setting if you want to avoid anonymous access being disabled accidentally by a subsequent upgrade.

xpack.security.authc.providers.anonymous.<provider-name>.order

Specifies order of the anonymous authentication provider in the authentication chain.

xpack.security.authc.providers.anonymous.<provider-name>.credentials

Specifies which credentials Kibana should use for anonymous users.

vis_type_table.legacyVisEnabled

Starting from version 7.11, a new datatable visualization is used. Set to true to enable the legacy version. In version 8.0 and later, the old implementation is removed and this setting is no longer supported.

vega.enableExternalUrls

Set to true to allow Vega vizualizations to use data from sources other than the linked Elasticsearch cluster. In version 8.0 and later, the vega.enableExternalUrls is not supported. Use vis_type_vega.enableExternalUrls instead.

vis_type_vega.enable

For 7.7 version and later, set to false to disable Vega vizualizations. Default: true

vis_type_vega.enableExternalUrls

Set this value to true to allow Vega to use any URL to access external data sources and images. When false, Vega can only get data from Elasticsearch. Default: false

You can configure the following X-Pack settings from the Kibana User Settings editor.

Stack Planned

xpack.actions.email.maximum_body_length

The maximum length of an email body in bytes. Values longer than this length will be truncated. The default is 25MB, the maximum is 25MB.

xpack.fleet.integrationRollbackTTL

Configure the time-to-live (TTL) for integration rollback availability. This setting controls how long the rollback option remains available after an integration is upgraded. The value must be specified in a duration format (for example, 7d, 14d, 168h, or 1w). Defaults to 7d (7 days). For more information, refer to Roll back an integration.

Stack 9.2.0

xpack.actions.email.recipient_allowlist

A list of allowed email recipient patterns (to, cc, or bcc) that can be used with email connectors. If you attempt to send an email to a recipient that does not match the allowed patterns, the action will fail. The failure message indicates that the email is not allowed.

Stack 9.1.0

xpack.actions.email.services.enabled

An array of strings indicating all email services that are enabled. Available options are elastic-cloud, google-mail, microsoft-outlook, amazon-ses, microsoft-exchange, and other. If the array is empty, no email services are enabled. The default value is ["*"], which enables all email services.

xpack.actions.email.services.ses.host

The SMTP endpoint for an Amazon Simple Email Service (SES) service provider that can be used by email connectors.

xpack.actions.email.services.ses.port

The port number for an Amazon Simple Email Service (SES) service provider that can be used by email connectors.

xpack.actions.webhook.ssl.pfx.enabled

Disable PFX file support for SSL client authentication. When set to false, the application will not accept PFX certificate files and will require separate certificate and private key files instead. Only applies to the Webhook connector.

xpack.banners.linkColor

The color for the banner link text. Defaults to #0B64DD.

xpack.product_intercept.enabled

Enable or disable Elastic product feedback prompts. Defaults to true.

xpack.product_intercept.interval:

Set the time that elapses between Elastic product feedback prompts. The time is formatted as a number and a time unit (d,h,m,s). For example, 20m, 24h, 7d. Defaults to 90d.

xpack.fleet.autoUpgrades.taskInterval:

Configure the interval of the automatic upgrade task for Fleet-managed Elastic Agents. Defaults to 30m.

xpack.fleet.autoUpgrades.retryDelays:

Configure the retry delays of the automatic upgrade task for Fleet-managed Elastic Agents. The array's length indicates the maximum number of retries. Defaults to ['30m', '1h', '2h', '4h', '8h', '16h', '24h'].

xpack.fleet.enableManagedLogsAndMetricsDataviews

Allow to disable the automatic creation of global dataviews logs-* and metrics-*.

xpack.task_manager.capacity

Controls the number of tasks that can be run at one time. Can be minimum 5 and maximum 50. Default: 10.

xpack.cases.files.allowedMimeTypes

The MIME types that you can attach to a case, represented in an array of strings. For example: ['image/tiff','text/csv','application/zip']. The default MIME types are specified in mime_types.ts.

xpack.cases.files.maxSize

The size limit for files that you can attach to a case, represented as the number of bytes. By default, the limit is 10 MiB for images and 100 MiB for all other MIME types. If you specify a value for this setting, it affects all file types.

xpack.actions.enableFooterInEmail

A boolean value indicating that a footer with a relevant link should be added to emails sent as alerting actions. Default: true.

xpack.actions.run.maxAttempts

Specifies the maximum number of times an action can be attempted to run. Can be minimum 1 and maximum 10.

xpack.actions.run.connectorTypeOverrides

Overrides the settings under xpack.actions.run for a connector type with the given ID. For example id:'.server-log', maxAttempts:5.

xpack.task_manager.monitored_stats_health_verbose_log.level

Set to info for Task Manager to log the health monitoring stats at info level instead of debug. Default: debug.

xpack.security.accessAgreement.message

This setting specifies the access agreement text in Markdown format that will be used as the default access agreement for all providers that do not specify a value for xpack.security.authc.providers.<provider-type>.<provider-name>.accessAgreement.message.

xpack.alerting.rules.run.alerts.max

Sets the maximum number of alerts that a rule can generate each time detection checks run. Defaults to 1000.

xpack.cloudSecurityPosture.enabled

Enables the Kibana UI for Elastic’s Cloud Security Posture solution. The solution provides audit & compliance checks on Cloud & Kubernetes environments. Defaults to false.

xpack.alerting.rules.run.actions.connectorTypeOverrides

Overrides the settings under xpack.alerting.rules.run.actions for a connector type with the given ID. For example id:'.server-log', max:1000.

xpack.alerting.rules.minimumScheduleInterval.value

Specifies the minimum schedule interval for rules. This minimum is applied to all rules created or updated after you set this value. Defaults to 1m.

xpack.alerting.rules.minimumScheduleInterval.enforce

Specifies the behavior when a new or changed rule has a schedule interval less than the value defined in xpack.alerting.rules.minimumScheduleInterval.value. If false, rules with schedules less than the interval will be created but warnings will be logged. If true, rules with schedules less than the interval cannot be created. Default: false.

xpack.alerting.rules.run.actions.max

Sets the maximum number of actions that a rule can trigger each time detection checks run (maximum 100000).

xpack.alerting.rules.run.timeout

Specifies the default timeout for the all rule types tasks.

xpack.alerting.rules.run.ruleTypeOverrides

Overrides the settings under xpack.alerting.rules.run for a rule type with the given id. e.g. (id:'index-threshold', timeout:'5m'),

xpack.alerting.cancelAlertsOnRuleTimeout

Set to false to enable writing alerts and scheduling actions even if rule execution is cancelled due to timeout. Defaults to true.

xpack.endpoint.enabled

Set to true to enable the Endpoint application.

xpack.fleet.enabled

Set to false to disable the Fleet application. Also enables the EPM and Agents features. For details about using this application, check the blog post Easier data onboarding with Elastic Agent and Ingest Manager.

xpack.fleet.agents.enabled

Set to false to disable the Agents API & UI.

xpack.ruleRegistry.write.disabledRegistrationContexts

Specifies the observability alert indices that are disabled to be written. Data type is array. Allowed values are: [ observability.logs,observability.metrics,observability.apm,observability.uptime ]

xpack.actions.email.domain_allowlist

A list of allowed email domains which can be used with the email connector. When this setting is not used, all email domains are allowed. When this setting is used, if any email is attempted to be sent that (a) includes an addressee with an email domain that is not in the allowlist, or (b) includes a from address domain that is not in the allowlist, it will fail with a message indicating the email is not allowed.

xpack.task_manager.event_loop_delay.monitor

Enables event loop delay monitoring, which will log a warning when a task causes an event loop delay which exceeds the warn_threshold setting. Defaults to true.

Note

This setting is not available in versions 8.0.0 through 8.1.1.

xpack.task_manager.event_loop_delay.warn_threshold

Sets the amount of event loop delay during a task execution which will cause a warning to be logged. Defaults to 5000 milliseconds (5 seconds).

Note

This setting is not available in versions 8.0.0 through 8.1.1. As such, this setting should be removed before upgrading from 7.17 to 8.0 or 8.1.0. It is possible to configure the settings in 7.17.2 and then upgrade to 8.2.0 directly.

xpack.alerting.defaultRuleTaskTimeout

Specifies the default timeout for the all rule types tasks. Defaults to 5m. Deprecated in versions 8.2+ and removed in versions 9.0+.

xpack.actions.microsoftGraphApiUrl

Specifies the URL to the Microsoft Graph server when using the MS Exchange Server email service. Defaults to https://graph.microsoft.com/v1.0.

xpack.alerting.maxEphemeralActionsPerAlert

Sets the number of actions that will be executed ephemerally. Defaults to 10.

xpack.task_manager.ephemeral_tasks.enabled

Enables an experimental feature that executes a limited (and configurable) number of actions in the same task as the alert which triggered them. These action tasks reduce the latency of the time it takes an action to run after it’s triggered, but are not persisted as SavedObjects. These non-persisted action tasks have a risk that they won’t be run at all if the Kibana instance running them exits unexpectedly. Defaults to false.

xpack.task_manager.ephemeral_tasks.request_capacity

Sets the size of the ephemeral queue. Defaults to 10.

xpack.actions.customHostSettings

An array of objects, one per host, containing the SSL/TLS settings used when executing connectors which make HTTPS and SMTP connections to the host servers. For details about using this setting, check Alerting and action settings in Kibana.

xpack.actions.ssl.proxyVerificationMode

Controls the verification of the proxy server certificate that hosted-ems receives when making an outbound SSL/TLS connection to the host server. Valid values are full, certificate, and none. Use full to perform hostname verification, certificate to skip hostname verification, and none to skip verification. Default: full.

xpack.actions.ssl.verificationMode

Controls the verification of the server certificate that hosted-ems receives when making an outbound SSL/TLS connection to the host server. Valid values are full, certificate, and none. Use full to perform hostname verification, certificate to skip hostname verification, and none to skip verification. Default: full.

xpack.task_manager.monitored_stats_health_verbose_log.enabled

Enable to allow the Kibana task manager to log at either a warning or error log level if it self-detects performance issues. Default: false.

xpack.task_manager.monitored_stats_health_verbose_log.warn_delayed_task_start_in_seconds

The number of seconds we allow a task to delay before printing a warning server log. Default: 60.

xpack.actions.preconfiguredAlertHistoryEsIndex

Set to true to enable experimental Alert history Elasticsearch index connector. Default: false.

xpack.discoverEnhanced.actions.exploreDataInContextMenu.enabled

Set to true to enable the "explore underlying data" menu action in dashboards. Default: false.

xpack.actions.proxyBypassHosts

Specifies hostnames which should not use the proxy, if using a proxy for actions. The value is an array of hostnames as strings. By default, all hosts will use the proxy. The settings xpack.actions.proxyBypassHosts and xpack.actions.proxyOnlyHosts cannot be used at the same time.

xpack.actions.proxyOnlyHosts

Specifies hostnames which should only be used with the proxy, if using a proxy for actions. The value is an array of hostnames as strings. By default, all hosts will use the proxy. The settings xpack.actions.proxyBypassHosts and xpack.actions.proxyOnlyHosts cannot be used at the same time.

xpack.actions.maxResponseContentLength

Specifies the max number of bytes of the HTTP response for requests to external resources. Defaults to 1mb.

xpack.actions.responseTimeout

Specifies the time allowed for requests to external resources. Requests that take longer are aborted. The time is formatted as <count>[ms|s|m|h|d|w|M|Y], for example, 20m, 24h, 7d, 1w. Defaults to 60s.

xpack.task_manager.monitored_task_execution_thresholds

Specifies the thresholds for failed task executions. If the percentage of failed executions exceeds the specified thresholds, the health of the task will be reported as configured. Can be specified at a default level or a custom level for specific task types. The following example shows a valid monitored_task_execution_thresholds configuration.

xpack.task_manager.monitored_task_execution_thresholds:
  default:
    error_threshold: 70
    warn_threshold: 50
  custom:
    "alerting:.index-threshold":
      error_threshold: 50
      warn_threshold: 0
		

xpack.task_manager.version_conflict_threshold

Specifies the threshold for version conflicts. If the percentage of version conflicts exceeds the threshold, the task manager poll_interval will automatically be adjusted. Default: 80.

xpack.actions.proxyUrl

Specifies the proxy URL to use, if using a proxy for actions.

xpack.actions.proxyHeaders

Specifies headers for proxy, if using a proxy for actions.

xpack.ingestManager.enabled

Set to false to disable the Ingest Manager application. Also enables the EPM and Fleet features. For details about using this application, check the blog post Easier data onboarding with Elastic Agent and Ingest Manager.

xpack.ingestManager.fleet.enabled

Set to false to disable the Fleet API & UI.

xpack.lists.maxImportPayloadBytes

Sets the number of bytes (default 9000000, maximum 100000000) allowed for uploading Security Solution value lists. For every 10 megabytes, it is recommended to have an additional 1 gigabyte of RAM reserved for Kibana. For example, on a Kibana instance with 2 gigabytes of RAM, you can set this value up to 20000000 (20 megabytes).

xpack.lists.importBufferSize

Sets the buffer size used for uploading Security Solution value lists (default 1000). Change the value if you are experiencing slow upload speeds or larger than wanted memory usage when uploading value lists. Set to a higher value to increase throughput at the expense of using more Kibana memory, or a lower value to decrease throughput and reduce memory usage.

xpack.security.sameSiteCookies

Sets the SameSite attribute of Set-Cookie HTTP header. It allows you to declare whether your cookie should be restricted to a first-party or same-site context. Not set by default, which makes modern browsers treat it as Lax. If you use Kibana embedded in an iframe in modern browsers, you might need to set it to None. Note that None usage requires secure context: xpack.security.secureCookies: true. Some old versions of IE11 do not support SameSite: None, so you should not specify xpack.security.sameSiteCookies at all.

xpack.ingestManager.enabled

Set to true (default false) to enable the Ingest Manager application. Also enables the EPM and Fleet features. For details about using this application, check the blog post Easier data onboarding with Elastic Agent and Ingest Manager.

xpack.ingestManager.epm.enabled

Set to true (default) to enable the EPM API & UI.

xpack.ingestManager.fleet.enabled

Set to true (default) to enable the Fleet API & UI.

xpack.task_manager.max_workers

Specify the maximum number of tasks a Kibana will run concurrently. Default: 10. Deprecated in versions 8.16+

xpack.task_manager.poll_interval

Specify how often, in milliseconds, a Kibana should check for more tasks. Default: 3000.

xpack.eventLog.logEntries

Set to true to enable logging event log documents from alerting to the Kibana log, in addition to being indexed into the event log index. Default: false.

xpack.security.session.idleTimeout

Set the session duration. The format is a string of count and unit, where unit is one of ms,s,m,h,d,w,M,Y. For example, 70ms, 5s, 3d, 1Y. To learn more, check Security settings in Kibana.

xpack.security.session.lifespan

Sets the maximum duration, also known as "absolute timeout". After this duration, the session will expire even if it is not idle. To learn more, check Security settings in Kibana.

xpack.maps.showMapVisualizationTypes

Set to true if you want to create new region map visualizations.

xpack.actions.allowedHosts

Set to an array of host names which actions such as email, slack, pagerduty, and webhook can connect to. An element of * indicates any host can be connected to. An empty array indicates no hosts can be connected to. Default: [ * ]

xpack.actions.enabledActionTypes

Set to an array of action types that are enabled. An element of * indicates all action types registered are enabled. The action types provided by Kibana are: .server-log, .slack, .email, .index, .pagerduty, .webhook. Default: [ * ]

xpack.grokdebugger.enabled

Set to true (default) to enable the Grok Debugger.

xpack.graph.enabled

Set to false to disable X-Pack graph.

xpack.monitoring.cluster_alerts.email_notifications.email_address

When enabled, specifies the email address to receive cluster alert notifications.

xpack.monitoring.kibana.collection.interval

Controls how often data samples are collected.

xpack.monitoring.min_interval_seconds

Specifies the minimum number of seconds that a time bucket in a chart can represent. If you modify the xpack.monitoring.kibana.collection.interval, use the same value in this setting.

xpack.monitoring.ui.container.elasticsearch.enabled

For Elasticsearch clusters that run in containers, enables the Node Listing to display the CPU utilization based on the Cgroup statistics, and adds the Cgroup CPU utilization to the Node Overview page instead of the overall operating system CPU utilization.

xpack.ml.enabled

Set to true (default) to enable machine learning.

If set to false in kibana.yml, the machine learning icon is hidden in this Kibana instance. If xpack.ml.enabled is set to true in elasticsearch.yml, however, you can still use the machine learning APIs. To disable machine learning entirely, check the Elasticsearch Machine Learning Settings.

csp.script_src

Add sources for the Content Security Policy script-src directive. When csp.strict is true, csp.script_src may not be unsafe-inline. Rules may not contain nonce-* or none and will not override the defaults. Default: ['unsafe-eval', 'self']

csp.worker_src

Add sources for the Content Security Policy worker-src directive. Rules may not contain nonce-* or none and will not override the defaults. Default: [blob:, 'self']

csp.style_src

Add sources for the Content Security Policy style-src directive. Rules may not contain nonce-* or none and will not override the defaults. Default: ['unsafe-inline', 'self']

csp.connect_src

Add sources for the Content Security Policy connect-src directive.

csp.default_src

Add sources for the Content Security Policy default-src directive.

csp.font_src

Add sources for the Content Security Policy font-src directive.

csp.frame_src

Add sources for the Content Security Policy frame-src directive.

csp.img_src

Add sources for the Content Security Policy img-src directive.

csp.object_src Stack Planned

Add sources for the Content Security Policy object-src directive.

csp.report_uri

Add sources for the Content Security Policy report-uri directive.

csp.report_only.form_action

Add sources for the Content Security Policy form-action directive in reporting mode.

csp.strict

Blocks Kibana access to any browser that does not enforce even rudimentary CSP rules. In practice, this disables support for older, less safe browsers like Internet Explorer. Default: true To learn more, check Configure Kibana].

csp.warnLegacyBrowsers

Shows a warning message after loading Kibana to any browser that does not enforce even rudimentary CSP rules, though Kibana is still accessible. This configuration is effectively ignored when csp.strict is enabled. Default: true

csp.disableUnsafeEval Stack Preview

Set this to true to remove the unsafe-eval source expression from the script-src directive. Default: false

By enabling csp.disableUnsafeEval, Kibana will use a custom version of the Handlebars template library which doesn’t support inline partials. Handlebars is used in various locations in the Kibana frontend where custom templates can be supplied by the user when for instance setting up a visualisation. If you experience any issues rendering Handlebars templates after turning on csp.disableUnsafeEval, or if you rely on inline partials, please revert this setting to false and open an issue in the Kibana GitHub repository.

permissionsPolicy.report_to

Add sources for the permissions policy report-to directive. To learn more, see Configure Kibana

Banners are disabled by default. You need to manually configure them in order to use the feature.

xpack.banners.placement

Set to top to display a banner above the Elastic header. Defaults to disabled.

xpack.banners.textContent

The text to display inside the banner, either plain text or Markdown.

xpack.banners.textColor

The color for the banner text. Defaults to #8A6A0A.

xpack.banners.backgroundColor

The color of the banner background. Defaults to #FFF9E8.

xpack.banners.disableSpaceBanners

If true, per-space banner overrides are disabled. Defaults to false.

xpack.reporting.csv.scroll.strategy

Choose the API method used to page through data during CSV export. Valid options are scroll and pit. Defaults to pit.

xpack.reporting.csv.scroll.duration

Amount of time allowed before Kibana cleans the scroll context during a CSV export. Valid option is either auto or time, Defaults to 30s.

xpack.reporting.enabled

Set to false to completely disable reporting.

xpack.reporting.queue.timeout

Specifies the time each worker has to produce a report. If your machine is slow or under heavy load, you might need to increase this timeout. Specified in milliseconds (number) or duration (string). Duration is a string value formatted as <count>[ms|s|m|h|d|w|M|Y], for example, 20m, 24h, 7d, 1w.

Defaults to 120000 (2 minutes)

xpack.reporting.capture.maxAttempts

Specifies how many retries to attempt in case of occasional failures.

Defaults to 3.

xpack.screenshotting.capture.timeouts.openUrl

Specify how long to allow the Reporting browser to wait for the "Loading…" screen to dismiss and find the initial data for the Kibana page. If the time is exceeded, a page screenshot is captured showing the current state, and the download link shows a warning message.

Defaults to 30000 (30 seconds).

xpack.screenshotting.capture.timeouts.waitForElements

Specify how long to allow the Reporting browser to wait for all visualization panels to load on the Kibana page. If the time is exceeded, a page screenshot is captured showing the current state, and the download link shows a warning message.

Defaults to 30000 (30 seconds).

xpack.screenshotting.capture.timeouts.renderComplete

Specify how long to allow the Reporting browser to wait for all visualizations to fetch and render the data. If the time is exceeded, a page screenshot is captured showing the current state, and the download link shows a warning message.

Defaults to 30000 (30 seconds).

xpack.screenshotting.capture.browser.type

Specifies the browser to use to capture screenshots. Valid options are phantom and chromium.

Beginning with version 7.0, chromium is the only allowed option. Defaults to phantom for earlier versions.

xpack.reporting.csv.maxSizeBytes

Sets the maximum size of a CSV file before being truncated. This setting exists to prevent large exports from causing performance and storage issues. Until 7.15, maximum allowed value is 50 MB (52428800 Bytes).

Defaults to 250MB. Elastic Stack versions before 8.10 default to 10485760 (10MB).

xpack.reporting.encryptionKey

Set to any text string. To provide your own encryption key for reports, use this setting.

xpack.reporting.roles.enabled

When true, grants users access to the reporting features when they are assigned the reporting_user role. Granting access to users this way is deprecated. Set to false and use Kibana privileges instead.

Defaults to true.

xpack.reporting.csv.scroll.duration

Amount of time allowed before Kibana cleans the scroll context during a CSV export.

Defaults to 30s (30 seconds).

xpack.reporting.csv.scroll.size

Sets the number of documents retrieved from Elasticsearch for each scroll iteration during Kibana CSV export. Defaults to 500.

xpack.reporting.csv.checkForFormulas

Enables a check that warns you when there’s a potential formula included in the output (=, -, +, and @ chars). See OWASP: https://www.owasp.org/index.php/CSV_Injection. Defaults to true.

xpack.reporting.csv.escapeFormulaValues

Escapes formula values in cells with a '. See OWASP: https://www.owasp.org/index.php/CSV_Injection. Defaults to true.

xpack.reporting.csv.useByteOrderMarkEncoding

Adds a byte order mark (\ufeff) at the beginning of the CSV file. Defaults to false.

The following logging settings are supported:

logging.root.level

Can be used to adjust Kibana’s logging level. Allowed values are fatal, error, warn, info, debug, trace, and all. Setting this to all causes all events to be logged, including system usage information, all requests, and Elasticsearch queries. This has a similar effect to enabling both logging.verbose and elasticsearch.logQueries in older 7.x versions. Setting to error has a similar effect to enabling logging.quiet in older 7.x versions. Defaults to info.

xpack.security.audit.enabled

When set to true, audit logging is enabled for security events. Defaults to false.

xpack.security.audit.appender.type

When set to "rolling-file" and xpack.security.audit.enabled is set to true, Kibana ECS audit logs are enabled. Beginning with version 8.0, this setting is no longer necessary for ECS audit log output; it’s only necessary to set xpack.security.audit.enabled to true

logging.verbose

If set to true, all events are logged, including system usage information and all requests. Defaults to false.

logging.quiet

If set to true, all logging output other than error messages is suppressed. Defaults to false.

elasticsearch.logQueries

When set to true, queries sent to Elasticsearch are logged (requires logging.verbose set to true). Defaults to false.

xpack.security.audit.enabled

When set to true, audit logging is enabled for security events. Defaults to false.

xpack.security.audit.ignore_filters

List of filters that determine which audit events should be excluded from the ECS audit log.

xpack.security.audit.ignore_filters.actions

List of values matched against the event.action field of an audit event.

xpack.security.audit.ignore_filters.categories

List of values matched against the event.category field of an audit event.

xpack.security.audit.ignore_filters.outcomes

List of values matched against the event.outcome field of an audit event.

xpack.security.audit.ignore_filters.spaces

List of values matched against the kibana.space_id field of an audit event. This represents the space id in which the event took place.

xpack.security.audit.ignore_filters.types

List of values matched against the event.type field of an audit event.

xpack.security.audit.ignore_filters.users

List of values matched against the user.name field of an audit event. This represents the username associated with the audit event.

The following APM settings are supported in Kibana:

xpack.apm.autoCreateApmDataView

Set to false to disable the automatic creation of the APM data view when the APM app is opened. Defaults to true. This setting was called xpack.apm.autocreateApmIndexPattern in versions prior to 8.0.0.

xpack.apm.ui.transactionGroupBucketSize

Number of top transaction groups displayed in the APM app. Defaults to 1000.

xpack.apm.maxServiceEnvironments

Maximum number of unique service environments recognized by the UI. Defaults to 100.

xpack.apm.autocreateApmIndexPattern

Set to false to disable the automatic creation of the APM data view when the APM app is opened. Defaults to true. This setting is renamed to xpack.apm.autoCreateApmDataView in version 8.0.0.

xpack.apm.serviceMapFingerprintBucketSize

Maximum number of unique transaction combinations sampled for generating service map focused on a specific service. Defaults to 100.

xpack.apm.serviceMapFingerprintGlobalBucketSize

Maximum number of unique transaction combinations sampled for generating the global service map. Defaults to 100.

xpack.apm.serviceMapEnabled

Set to false to disable service maps. Defaults to true.

xpack.apm.serviceMapTraceIdBucketSize

Maximum number of trace IDs sampled for generating service map focused on a specific service. Defaults to 65.

xpack.apm.serviceMapTraceIdGlobalBucketSize

Maximum number of trace IDs sampled for generating the global service map. Defaults to 6.

xpack.apm.serviceMapMaxTracesPerRequest

Maximum number of traces per request for generating the global service map. Defaults to 50.

xpack.observability.annotations.index

Index name where Observability annotations are stored. Defaults to observability-annotations.

xpack.apm.metricsInterval

Sets a fixed_interval for date histograms in metrics aggregations. Defaults to 30.

xpack.apm.agent.migrations.enabled

Set to false to disable cloud APM migrations. Defaults to true.

xpack.apm.indices.span

Matcher for indices containing span documents. Defaults to apm-*.

xpack.apm.indices.error

Matcher for indices containing error documents. Defaults to apm-*.

xpack.apm.indices.transaction

Matcher for indices containing transaction documents. Defaults to apm-*.

xpack.apm.indices.onboarding

Matcher for all onboarding indices. Defaults to apm-*.

xpack.apm.indices.metric

Matcher for all metrics indices. Defaults to apm-*.

xpack.apm.indices.sourcemap

Matcher for all source map indices. Defaults to apm-*.

xpack.apm.maxSuggestions

Maximum number of suggestions fetched in autocomplete selection boxes. Defaults to 100

xpack.apm.searchAggregatedTransactions

Whether to use metric instead of transaction documents to render the UI. Available options are always, never or auto. Defaults to auto.

xpack.apm.ui.maxTraceItems

Maximum number of child items displayed when viewing trace details.

Defaults to 1000. Any positive value is valid. To learn more, check APM settings in Kibana.

xpack.apm.ui.enabled

Set to false to disable X-Pack APM UI.