Step 4: Set up the Kibana dashboardsedit

Packetbeat comes packaged with example Kibana dashboards, visualizations, and searches for visualizing Packetbeat data in Kibana. Before you can use the dashboards, you need to create the index pattern, packetbeat-*, and load the dashboards into Kibana. To do this, you can either run the setup command (as described here) or configure dashboard loading in the packetbeat.yml config file.


Starting with Beats 6.0.0, the dashboards are loaded via the Kibana API. This requires a Kibana endpoint configuration. You should have configured the endpoint earlier when you configured Packetbeat. If you didn’t, configure it now.

Make sure Kibana is running before you perform this step. If you are accessing a secured Kibana instance, make sure you’ve configured credentials as described in Step 2: Configure Packetbeat.

To set up the Kibana dashboards for Packetbeat, use the appropriate command for your system.


Use sudo to run these commands if the config file is owned by root.

deb and rpm:

packetbeat setup --dashboards


./packetbeat setup --dashboards


docker run setup --dashboards


Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator). If you are running Windows XP, you may need to download and install PowerShell.

From the PowerShell prompt, change to the directory where you installed Packetbeat, and run:

PS > packetbeat setup --dashboards