Observability Kibana privileges

Roles control what users can access and what actions they can perform. When you create or edit a role, you grant it Kibana privileges, which give access to individual features within one or more spaces.

When you add Kibana privileges to a role, the Assign role to spaces flyout opens. Access to Observability features is controlled by the privileges in the Observability group, described on this page.

For more details on creating a role, refer to Role management using Kibana for Elastic Stack, or to Serverless project custom roles for Serverless.

Kibana feature privileges do not grant Elasticsearch cluster or index privileges. Users still need the matching index privileges for the data they query.

For each of the feature privileges, select the type of access you want to allow:

  • All: Users have full access to the feature, which includes performing all available actions and managing configuration.
  • Read: Users can view the feature, but can't perform any actions or manage configuration.
  • None: Users can't access or view the feature.
Note

Some features don't have a Read privilege.

Each of the following privileges controls access to a different part of Observability.

Privilege What it allows
Logs Access Logs and related apps, including Logs Explorer. Create and manage logs alert rules and alerts.
Infrastructure Access Infrastructure and related metrics apps. Create and manage infrastructure alert rules and alerts.
APM and User Experience Access Applications (APM) and User Experience. Create and manage APM alert rules and alerts. Turn on Customize sub-feature privileges to grant individual privileges. Refer to APM and User Experience sub-feature privileges.
In Serverless, this privilege is called Applications.
Synthetics and Uptime Access Synthetics and Uptime. Create and manage monitors, settings, and Synthetics and Uptime alert rules and alerts. Turn on Customize sub-feature privileges to grant individual privileges. Refer to Synthetics and Uptime sub-feature privileges.
In Serverless, this privilege is called Synthetics.
Cases Access cases. Turn on Customize sub-feature privileges to grant individual case privileges. For the full list, refer to Customize sub-feature privileges for cases.
SLOs Access service-level objectives (SLOs). Create and manage SLOs and burn rate rules and alerts. For the matching Elasticsearch index privileges, refer to Configure SLO access.
Universal Profiling Access Universal Profiling. All and Read grant the same Universal Profiling access.
Observability Alerts Read Observability alerts and perform per-alert actions such as snooze, unsnooze, and acknowledge, without managing rules. For details, refer to Give access to triage alerts without managing rules.
Observability AI Assistant Access the Observability AI Assistant. This privilege has no Read level.
Streams Access Streams.
This privilege is in the Management group.
Inventory Access Inventory. Roles that use this privilege keep working only on 9.0.
Note

In Serverless, the Observability group also includes privileges that belong to the Analytics group or Management group in Elastic Stack, such as Dashboards, Discover, Machine Learning, Workflows Management, Agent Builder, and Context Engine. Which ones appear depends on your project feature tier.

These privileges control specific Applications (APM) settings. Selecting All for APM and User Experience (or Applications in Serverless) includes everything in the following table.

Privilege What it allows
Ability to modify settings Change Applications (APM) settings.

These privileges control specific Synthetics actions. Selecting All for Synthetics and Uptime (or Synthetics in Serverless) includes Enabled and Can manage. The other privileges in this table are opt-in: grant them separately even when the feature privilege is All.

Privilege What it allows
Can run tests manually Trigger a manual test run of an existing monitor without creating, editing, or deleting monitors.
Enabled Under Elastic managed locations, create monitors that run from Elastic managed locations. There is an additional charge to use Elastic managed testing locations.
Can manage Under Private locations, add and delete private locations.
Can read global parameter values View unredacted global parameter values.
Can manage rules Create, update, delete, enable, disable, run, and backfill Synthetics and Uptime alert rules, including the default status and TLS rules, without granting permission to create or edit monitors.