Add Kibana user settings

Elasticsearch Service supports most of the standard Kibana and X-Pack settings. Through a YAML editor in the console, you can append Kibana properties to the kibana.yml file. Your changes to the configuration file are read on startup.

Be aware that some settings that could break your cluster if set incorrectly and that the syntax might change between major versions. Before upgrading, be sure to review the full list of the latest Kibana settings and syntax.

To change Kibana settings:

  1. Log in to the Elasticsearch Service Console.
  2. Select your deployment on the home page in the Elasticsearch Service card or go to the deployments page.

    Narrow your deployments by name, ID, or choose from several other filters. To customize your view, use a combination of filters, or change the format from a grid to a list.

  3. From your deployment menu, go to the Edit page.
  4. At the bottom of the Kibana instance, expand the User settings overrides caret.
  5. Update the user settings.
  6. Click Save changes.

Saving your changes initiates a configuration plan change that restarts Kibana automatically for you.

If a setting is not supported by Elasticsearch Service, you will get an error message when you try to save.

Supported Kibana settings

Specifies the time in milliseconds to wait for autocomplete suggestions from Elasticsearch. The default is 1000. Allowed values are between 1 and 1200000. Available on Kibana 7.3 and higher. To learn more, see Configuring Kibana.
Specifies the max number of documents loaded by each shard to generate autocomplete suggestions. The default is 100000. Allowed values are between 1 and 10000000. Available on Kibana 7.3 and higher. To learn more, see Configuring Kibana.
Specifies additional vector layers for use in Region Map visualizations. Each layer object points to an external vector file that contains a geojson FeatureCollection. The file must use the WGS84 coordinate reference system and only include polygons. If the file is hosted on a separate domain from Kibana, the server needs to be CORS-enabled so Kibana can download the file. The following example shows a valid regionmap configuration.
  includeElasticMapsService: false
    - name: "Departments of France"
      url: ""
      attribution:   "INRAP"
        - name: "department"
          description: "Full department name"
        - name: "INSEE"
          description: "INSEE numeric identifier"
Turns on or off whether layers from the Elastic Maps Service should be included in the vector layer option list. Supported on Elastic Cloud Enterprise. By turning this off, only the layers that are configured here will be included. The default is true.
Optional. References the originating source of the geojson file.
Mandatory. Each layer can contain multiple fields to indicate what properties from the geojson features you wish to expose. The example above shows how to define multiple properties.
Mandatory. The human readable text that is shown under the Options tab when building the Region Map visualization.
Mandatory. This value is used to do an inner-join between the document stored in Elasticsearch and the geojson file. For example, if the field in the geojson is called Location and has city names, there must be a field in Elasticsearch that holds the same values that Kibana can then use to lookup for the geoshape data.
Mandatory. A description of the map being provided.
Mandatory. The location of the geojson file as provided by a webserver.
Specifies the default route when opening Kibana. You can use this setting to modify the landing page when opening Kibana.
Specifies HTTP header names and values that the Kibana backend will return to the client. Available since version 5.6.0.

Adds the map attribution string.

In version 7.0, all tilemap settings now begin with map.. For example, tilemap.options becomes map.tilemap.options

Sets the maximum zoom level.
Sets the minimum zoom level.
Provides an array of subdomains used by the tile service. Specify the position of the subdomain the URL with the token {s}.
Lists the URL to the tileservice that Kibana uses to display map tiles in tilemap visualizations.
Specifies the locale for all strings, dates, and number formats that can be localized. Defaults to en (English).

For version 7.x The Timelion application no longer appears by default in the Kibana side navigation.

Set to true to add Timelion back in the side navigation.

For version 6.0 and higher set to true to allow Vega vizualizations to use data from sources other than the linked Elasticsearch cluster.
If you are using SAML to secure your clusters, these settings are supported in Elasticsearch Service.

For version 7.5 and later, the following SAML user settings are also supported:
Specifies the maximum size of the URL that Kibana is allowed to store during the SAML handshake. See SAML and long URLs.

For version 7.2 and later, the following SAML user settings are also supported:
Specifies which SAML realm in Elasticsearch should be used.
Specifies which providers are going to be used in Kibana.

The following settings are deprecated and are not supported in version 8.0 * * * *

For version 6.4 and later, The following SAML user settings are also supported:
Set to saml to instruct Kibana to use SAML SSO as the authentication method.
Whitelists the SAML authentication URL within Kibana, so that the Kibana server doesn’t reject external authentication messages that originate from your Identity Provider.
Set to HTTP or HTTPS. To access Kibana, HTTPS protocol is recommended.
Set to a fully qualified hostname to connect your users to the proxy server.
The port number that connects your users to the proxy server (for example, 80 for HTTP or 443 for HTTPS).

To learn more, see configuring Kibana to use SAML.

OpenID Connect
The following OpenID Connect user settings are supported:
Specifies which OpenID Connect realm in Elasticsearch should be used.

To learn more, see configuring Kibana to use OpenID Connect.
Specifies the session duration in milliseconds. Allows a value between 15000 (15 seconds) and 86400000 (1 day). To learn more, see Security settings in Kibana. Deprecated in versions 7.6+ and removed in versions 8.0+.

X-Pack configuration settings

You can configure the following X-Pack settings from the Kibana User Settings editor.

For version 7.8 and later:

Set to true (default false) to enable the Ingest Manager application. Also enables the EPM and Fleet features.
Set to true (default) to enable the EPM API & UI.
Set to true (default) to enable the Fleet API & UI.

For version 7.6 and later:
Set the session duration. The format is a string of count and unit, where unit is one of ms,s,m,h,d,w,M,Y. For example, 70ms, 5s, 3d, 1Y. To learn more, see Security settings in Kibana.
Sets the maximum duration, also known as "absolute timeout". After this duration, the session will expire even if it is not idle. To learn more, see Security settings in Kibana.
Set to true if you want to create new region map visualizations.
Set to an array of host names which actions such as email, slack, pagerduty, and webhook can connect to. An element of * indicates any host can be connected to. An empty array indicates no hosts can be connected to. Default: [ * ]
Set to an array of action types that are enabled. An element of * indicates all action types registered are enabled. The action types provided by Kibana are: .server-log, .slack, .email, .index, .pagerduty, .webhook. Default: [ * ]

For version 5.0 and later:

Set to true (default) to enable the Grok Debugger.
Set to false to disable X-Pack graph.
When enabled, specifies the email address to receive cluster alert notifications. As of version 6.5, replaces the xpack:defaultAdminEmail setting for monitoring.
Controls how often data samples are collected.
Specifies the minimum number of seconds that a time bucket in a chart can represent. If you modify the xpack.monitoring.kibana.collection.interval, use the same value in this setting.

For Elasticsearch clusters that run in containers, enables the Node Listing to display the CPU utilization based on the Cgroup statistics, and adds the Cgroup CPU utilization to the Node Overview page instead of the overall operating system CPU utilization.

Defaults to false.

Set to true (default) to enable machine learning.

If set to false in kibana.yml, the machine learning icon is hidden in this Kibana instance. If is set to true in elasticsearch.yml, however, you can still use the machine learning APIs. To disable machine learning entirely, see the Elasticsearch Machine Learning Settings.

Set to false to completely disable reporting.
Set to false to stop the Kibana instance from claiming and executing queued reporting jobs. Reports can still be downloaded from the instance.

How long each worker has to produce a report. If your machine is slow or under heavy load, you might need to increase this timeout. Specified in milliseconds.

Defaults to 30000 (30 seconds).


Specifies the browser to use to capture screenshots. Valid options are phantom and chromium.

Beginning with version 7.0, chromium is the only allowed option. Defaults to phantom for earlier versions.


Specifies how many retries to attempt in case of occasional failures.

Defaults to 3.


Sets the maximum size of a CSV file before being truncated. This setting exists to prevent large exports from causing performance and storage issues. Maximum allowed value is 50 MB (52428800 Bytes).

Defaults to 10485760 (10mB).

Set to any text string. To provide your own encryption key for reports, use this setting.
The following APM settings are supported in Kibana:
Set to false to disable X-Pack APM UI.
Matcher for indices containing span documents. Defaults to apm-*.
Matcher for indices containing error documents. Defaults to apm-*.
Matcher for indices containing transaction documents. Defaults to apm-*.