Configure Kibanaedit
The Kibana server reads properties from the kibana.yml
file on startup. The
location of this file differs depending on how you installed Kibana. For example,
if you installed Kibana from an archive distribution (.tar.gz
or .zip
), by
default it is in $KIBANA_HOME/config
. By default, with package distributions
(Debian or RPM), it is in /etc/kibana
. The config directory can be changed via the
KBN_PATH_CONF
environment variable:
KBN_PATH_CONF=/home/kibana/config ./bin/kibana
The default host and port settings configure Kibana to run on localhost:5601
. To change this behavior and allow remote users to connect, you’ll need to update your kibana.yml
file. You can also enable SSL and set a
variety of other options. Finally, environment variables can be injected into
configuration using ${MY_ENV_VAR}
syntax.
|
Toggling this causes the server to regenerate assets on the next startup,
which may cause a delay before pages start being served.
Set to |
|
[7.14.0] Deprecated in 7.14.0. In 8.0 and later, this setting will no longer be supported. A Content Security Policy template that disables certain unnecessary and potentially insecure capabilities in the browser. It is strongly recommended that you keep the default CSP rules that ship with Kibana. |
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
The frame-ancestors
directive can also be configured by using
server.securityResponseHeaders.disableEmbedding
. In that case, that takes precedence and any values in csp.frame_ancestors
are ignored.
|
Add sources for the Content Security Policy |
|
Add sources for the Content Security Policy |
Blocks Kibana access to any browser that
does not enforce even rudimentary CSP rules. In practice, this disables
support for older, less safe browsers like Internet Explorer.
For more information, refer to Content Security Policy.
Default: |
|
|
Shows a warning message after loading Kibana to any browser that does not
enforce even rudimentary CSP rules, though Kibana is still accessible. This
configuration is effectively ignored when |
The maximum number of sockets that can be used for communications with elasticsearch.
Default: |
|
|
Header names and values to send to Elasticsearch. Any custom headers cannot be
overwritten by client-side headers, regardless of the
|
The URLs of the Elasticsearch instances to use for all your queries. All nodes
listed here must be on the same cluster. Default: To enable SSL/TLS for outbound connections to Elasticsearch, use the |
|
|
[7.12.0]
Deprecated in 7.12.0. This setting is no longer used and will be removed in Kibana 8.0.
Instead, configure the The following example shows a valid verbose |
logging: appenders: console_appender: type: console layout: type: pattern highlight: true root: appenders: [console_appender] level: warn loggers: - name: elasticsearch.query level: debug
Time in milliseconds to wait for Elasticsearch to respond to pings.
Default: the value of the |
|
List of Kibana client-side headers to send to Elasticsearch. To send no client-side
headers, set this value to [] (an empty list). Removing the |
|
Time in milliseconds to wait for responses from the back end or Elasticsearch.
This value must be a positive integer. Default: |
|
|
Time in milliseconds for Elasticsearch to wait for responses from shards.
Set to 0 to disable. Default: |
|
Specifies whether Kibana should use compression for communications with Elasticsearch. Default: |
|
Time in milliseconds between requests to check Elasticsearch for an updated list of
nodes. Default: |
|
Attempt to find other Elasticsearch nodes on startup. Default: |
|
Update the list of Elasticsearch nodes immediately following a connection fault.
Default: |
Controls Kibana behavior in regard to presenting a client certificate when
requested by Elasticsearch. This setting applies to all outbound SSL/TLS connections
to Elasticsearch, including requests that are proxied for end users. Default: |
When Elasticsearch uses certificates to authenticate end users with a PKI realm
and elasticsearch.ssl.alwaysPresentCertificate
is true
,
proxied requests may be executed as the identity that is tied to the Kibana
server.
Paths to a PEM-encoded X.509 client certificate and its corresponding
private key. These are used by Kibana to authenticate itself when making
outbound SSL/TLS connections to Elasticsearch. For this setting to take effect, the
|
These settings cannot be used in conjunction with
elasticsearch.ssl.keystore.path
.
Paths to one or more PEM-encoded X.509 certificate authority (CA) certificates, which make up a trusted certificate chain for Elasticsearch. This chain is used by Kibana to establish trust when making outbound SSL/TLS connections to Elasticsearch. In addition to this setting, trusted certificates may be specified via
|
|
|
The password that decrypts the private key that is specified
via |
Path to a PKCS#12 keystore that contains an X.509 client certificate and it’s
corresponding private key. These are used by Kibana to authenticate itself when
making outbound SSL/TLS connections to Elasticsearch. For this setting, you must also set
the If the keystore contains any additional certificates, they are used as a
trusted certificate chain for Elasticsearch. This chain is used by Kibana to establish
trust when making outbound SSL/TLS connections to Elasticsearch. In addition to this
setting, trusted certificates may be specified via
|
This setting cannot be used in conjunction with
elasticsearch.ssl.certificate
or elasticsearch.ssl.key
.
|
The password that decrypts the keystore specified via
|
Path to a PKCS#12 trust store that contains one or more X.509 certificate authority (CA) certificates, which make up a trusted certificate chain for Elasticsearch. This chain is used by Kibana to establish trust when making outbound SSL/TLS connections to Elasticsearch. In addition to this setting, trusted certificates may be specified via
|
|
|
The password that decrypts the trust store specified via
|
Controls the verification of the server certificate that Kibana receives when
making an outbound SSL/TLS connection to Elasticsearch. Valid values are |
|
If your Elasticsearch is protected with basic authentication, these settings provide the username and password that the Kibana server uses to perform maintenance on the Kibana index at startup. Kibana users still need to authenticate with Elasticsearch, which is proxied through the Kibana server. |
|
If your Elasticsearch is protected with basic authentication, this token provides the credentials
that the Kibana server uses to perform maintenance on the Kibana index at startup. This setting
is an alternative to |
|
|
Enables use of interpreter in Visualize. Default: |
Time in milliseconds to wait for autocomplete suggestions from Elasticsearch.
This value must be a whole number greater than zero. Default: |
|
Maximum number of documents loaded by each shard to generate autocomplete
suggestions. This value must be a whole number greater than zero.
Default: |
To reload the logging settings, send a SIGHUP signal to Kibana. For more logging configuration options, see the Configure Logging in Kibana guide.
The |
|
A list of logging appenders to forward the root level logger instance to. By default |
|
Level at which a log record should be logged. Supported levels are: all, fatal, error, warn, info, debug, trace, off. Levels are ordered from all (highest) to off and a log record will be logged it its level is higher than or equal to the level of its logger, otherwise the log record is ignored. Use this value to change the overall log level. Default: |
|
Set to The following example shows a valid verbose |
logging: appenders: console_appender: type: console layout: type: pattern highlight: true root: appenders: [console_appender] level: all
Allows you to customize a specific logger instance. |
|
|
Appenders define how and where log messages are displayed (eg. stdout or console) and stored (eg. file on the disk). |
Set to |
|
|
Specifies the URL of a self hosted Elastic Maps Server |
The map attribution string. Provide attributions in markdown and use |
|
The maximum zoom level. Default: |
|
The minimum zoom level. Default: |
|
An array of subdomains
used by the tile service. Specify the position of the subdomain the URL with
the token |
|
The URL to the service that Kibana uses
as the default basemap in maps and vega maps. By default,
Kibana sets a basemap from the Elastic Maps Service, but users can
point to their own Tile Map Service. For example:
|
|
|
Defines the number of documents migrated at a time. The higher the value, the faster the Saved Objects migration process performs at the cost of higher memory consumption. If upgrade migrations results in Kibana crashing with an out of memory exception or fails due to an Elasticsearch |
|
Defines the maximum payload size for indexing batches of upgraded saved objects to avoid migrations failing due to a 413 Request Entity Too Large response from Elasticsearch. This value should be lower than or equal to your Elasticsearch cluster’s |
|
The number of times migrations retry temporary failures, such as a network timeout, 503 status code, or |
|
Controls whether to enable the newsfeed
system for the Kibana UI notification center. Set to |
The path where Kibana stores persistent data
not saved in Elasticsearch. Default: |
|
|
Specifies the path where Kibana creates the process ID file. |
|
Set the interval in milliseconds to sample
system and process performance metrics. The minimum value is 100. Default: |
Override for cgroup cpu path when mounted in a
manner that is inconsistent with |
|
Override for cgroup cpuacct path when mounted
in a manner that is inconsistent with |
|
The maximum count of saved objects that can be imported or exported.
This setting exists to prevent the Kibana server from running out of memory when handling
large numbers of saved objects. It is recommended to only raise this setting if you are
confident your server can hold this many objects in memory.
Default: |
|
The maximum byte size of a saved objects import that the Kibana server will accept.
This setting exists to prevent the Kibana server from running out of memory when handling
a large import payload. Note that this setting overrides the more general
|
|
Enables you to specify a path to mount Kibana at if you are
running behind a proxy. Use the |
|
The publicly available URL that end-users access Kibana at. Must include the protocol, hostname, port
(if different than the defaults for |
|
Set to |
|
|
[preview]
This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Set to |
|
[preview]
This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Set to |
|
[preview]
This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
List of origins permitted to access resources. You must specify explicit hostnames and not use |
|
Specifies an array of trusted hostnames, such as the Kibana host, or a reverse
proxy sitting in front of it. This determines whether HTTP compression may be used for responses, based on the request |
|
Controls whether the |
|
Controls whether the |
|
Controls whether the |
|
[preview]
This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Controls whether the |
Controls whether the |
|
Header names and values to
send on all responses to the client from the Kibana server. Default: |
|
Sets the grace period for Kibana to attempt to resolve any ongoing HTTP requests after receiving a |
|
This setting specifies the host of the
back end server. To allow remote users to connect, set the value to the IP address or DNS name of the Kibana server. Use |
|
|
The number of milliseconds to wait for additional data before restarting
the |
[7.13.0]
Deprecated in 7.13.0. In 8.0 and later, this setting will no longer be supported.
This setting has been renamed to |
|
The maximum payload size in bytes
for incoming server requests. Default: |
|
|
A human-readable display name that
identifies this Kibana instance. Default: |
Kibana is served by a back end server. This
setting specifies the port to use. Default: |
|
Sets whether or not the |
|
|
A list of IPv4 and IPv6 address which the |
Specifies whether Kibana should
rewrite requests that are prefixed with |
|
The number of milliseconds to wait before closing an
inactive socket. Default: |
|
Paths to a PEM-encoded X.509 server certificate and its corresponding private key. These are used by Kibana to establish trust when receiving inbound SSL/TLS connections from users. |
These settings cannot be used in conjunction with server.ssl.keystore.path
.
Paths to one or more PEM-encoded X.509 certificate authority (CA) certificates which make up a trusted certificate chain for Kibana. This chain is used by Kibana to establish trust when receiving inbound SSL/TLS connections from end users. If PKI authentication is enabled, this chain is also used by Kibana to verify client certificates from end users. In addition to this setting, trusted certificates may be specified via |
|
Details on the format, and the valid options, are available via the
OpenSSL cipher list format documentation.
Default: |
|
|
Controls the behavior in Kibana for requesting a certificate from client
connections. Valid values are |
Enables SSL/TLS for inbound connections to Kibana. When set to |
|
|
The password that decrypts the private key that is specified via |
Path to a PKCS#12 keystore that contains an X.509 server certificate and its corresponding private key. If the keystore contains any additional certificates, those will be used as a trusted certificate chain for Kibana. All of these are used by Kibana to establish trust when receiving inbound SSL/TLS connections from end users. The certificate chain is also used by Kibana to verify client certificates from end users when PKI authentication is enabled. In addition to this setting, trusted certificates may be specified via |
This setting cannot be used in conjunction with server.ssl.certificate
or server.ssl.key
|
The password that will be used to decrypt the keystore specified via |
Path to a PKCS#12 trust store that contains one or more X.509 certificate authority (CA) certificates which make up a trusted certificate chain for Kibana. This chain is used by Kibana to establish trust when receiving inbound SSL/TLS connections from end users. If PKI authentication is enabled, this chain is also used by Kibana to verify client certificates from end users. In addition to this setting, trusted certificates may be specified via |
|
|
The password that will be used to decrypt the trust store specified via |
|
Kibana binds to this port and redirects
all http requests to https over the port configured as |
An array of supported protocols with versions.
Valid protocols: |
|
The unique identifier for this Kibana instance. It must be a valid UUIDv4. It gets automatically generated on the first startup if not specified and persisted in the |
|
It is not recommended to disable protections for
arbitrary API endpoints. Instead, supply the |
*Default: [ ]* An array of API endpoints which should be exempt from Cross-Site Request Forgery ("XSRF") protections.
Setting this to |
|
|
If authentication is enabled,
setting this to |
When |
|
When |
|
|
Reporting your cluster statistics helps
us improve your user experience. Your data is never shared with anyone. Set to
|
Set this value to true to allow Vega to use any URL to access external data
sources and images. When false, Vega can only get data from Elasticsearch. Default: |
|
|
Set this value to false to disable the Cross-Cluster Replication UI.
Default: |
|
Enables the Explore underlying data option that allows you to open Discover from a dashboard panel and view the panel data. Default: When you create visualizations using the Lens drag-and-drop editor, you can use the toolbar to open and explore your data in Discover. For more information, check out Explore the data in Discover. |
Enables you to view the underlying documents in a data series from a dashboard panel. Default: |
|
|
Set this value to false to disable the Index Lifecycle Policies UI.
Default: |
|
Set this value to false to disable the Index Management UI.
Default: |
|
Set this value to false to disable the License Management UI.
Default: |
|
Set this value to false to disable the Remote Clusters UI.
Default: |
|
Set this value to false to disable the Rollup Jobs UI. Default: true |
|
Set this value to false to disable the Snapshot and Restore UI. Default: true |
|
Set this value to false to disable the Upgrade Assistant UI. Default: true |
Set this value to change the Kibana interface language.
Valid locales are: |