Step 4: Set up the Kibana dashboardsedit

Auditbeat comes packaged with example Kibana dashboards, visualizations, and searches for visualizing Auditbeat data in Kibana. Before you can use the dashboards, you need to create the index pattern, auditbeat-*, and load the dashboards into Kibana. To do this, you can either run the setup command (as described here) or configure dashboard loading in the auditbeat.yml config file.


Starting with Beats 6.0.0, the dashboards are loaded via the Kibana API. This requires a Kibana endpoint configuration. You should have configured the endpoint earlier when you configured Auditbeat. If you didn’t, configure it now.

Make sure Kibana is running before you perform this step.

To set up the Kibana dashboards for Auditbeat:

deb, rpm, and mac:

From the directory where you installed Auditbeat, run:

./auditbeat setup --dashboards


Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator). If you are running Windows XP, you may need to download and install PowerShell.

From the PowerShell prompt, change to the directory where you installed Auditbeat, and run:

PS > auditbeat setup --dashboards

Pass credentialsedit

If you’ve secured Elasticsearch and Kibana, you need to pass credentials when you run Auditbeat commands. You can specify credentials from the command line, or in the config file. For example, from the command line, specify:

auditbeat setup --dashboards -e -E output.elasticsearch.username=elastic -E output.elasticsearch.password=elastic -E setup.kibana.username=elastic -E setup.kibana.password=elastic

See Step 2: Configure Auditbeat for more information about specifying credentials in the config file.