ELK Stack — Install Kibana

3 minute read

Install Kibana

Kibana is the visualization layer of the ELK Stack. It connects to Elasticsearch and provides a web UI for searching, exploring, and building dashboards.

Install on Ubuntu/Debian

Since you already added the Elastic APT repository when installing Elasticsearch, installing Kibana is straightforward:

$ sudo apt install kibana -y

Install on CentOS/RHEL

$ sudo yum install kibana -y

Install on macOS (Homebrew)

$ brew install elastic/tap/kibana-full

Configure Kibana

Edit the Kibana configuration file:

$ sudo nano /etc/kibana/kibana.yml

Key settings:

# Kibana server port (default: 5601)
server.port: 5601

# Kibana server host (0.0.0.0 to allow remote access)
server.host: "0.0.0.0"

# Kibana server name
server.name: "my-kibana"

# Elasticsearch connection (for Elasticsearch 8.x with security)
elasticsearch.hosts: ["https://localhost:9200"]

# SSL verification (for self-signed certificates in dev)
elasticsearch.ssl.verificationMode: none

Connect Kibana to Elasticsearch (Enrollment Token)

Elasticsearch 8.x uses enrollment tokens to securely configure Kibana. This is the easiest method.

Step 1 — Generate the Token (if you don’t have one)

On the Elasticsearch server:

$ sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana

This prints a long enrollment token. Copy it.

Step 2 — Start Kibana

$ sudo systemctl daemon-reload
$ sudo systemctl enable kibana
$ sudo systemctl start kibana

Step 3 — Open Kibana in Your Browser

Navigate to: http://localhost:5601

You’ll see an enrollment page. Paste the enrollment token from Step 1.

Step 4 — Enter the Verification Code

Kibana will ask for a 6-digit verification code. Get it from the Kibana log:

$ sudo /usr/share/kibana/bin/kibana-verification-code

Enter the code in the browser.

Step 5 — Log In

Use the elastic superuser credentials:

  • Username: elastic
  • Password: The password generated during Elasticsearch installation (or the one you reset)

Connect Kibana Manually (Without Enrollment Token)

If the enrollment token has expired (valid for 30 minutes), you can configure Kibana manually.

Step 1 — Create a Kibana Service Account Token

$ curl -k -X POST -u elastic:<PASSWORD> \
  "https://localhost:9200/_security/service/elastic/kibana/credential/token/kibana-token"

Expected output:

{
  "created": true,
  "token": {
    "name": "kibana-token",
    "value": "AAEAAWVsYXN0aWMva2liYW5hL2tpYmFuYS10b2tlbjp..."
  }
}

Step 2 — Add the Token to Kibana Config

$ sudo nano /etc/kibana/kibana.yml

Add:

elasticsearch.serviceAccountToken: "AAEAAWVsYXN0aWMva2liYW5hL2tpYmFuYS10b2tlbjp..."

Step 3 — Configure SSL for Elasticsearch Connection

Copy the Elasticsearch CA certificate:

$ sudo cp /etc/elasticsearch/certs/http_ca.crt /etc/kibana/
$ sudo chown kibana:kibana /etc/kibana/http_ca.crt

Update kibana.yml:

elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/http_ca.crt"]
elasticsearch.ssl.verificationMode: full

Step 4 — Restart Kibana

$ sudo systemctl restart kibana

Verify Kibana Is Running

Check the service status:

$ sudo systemctl status kibana

Expected output:

● kibana.service - Kibana
     Loaded: loaded (/lib/systemd/system/kibana.service; enabled)
     Active: active (running) since ...

Check the Kibana API:

$ curl -s http://localhost:5601/api/status | python3 -m json.tool | head -20

Expected output (truncated):

{
  "name": "my-kibana",
  "uuid": "...",
  "version": {
    "number": "8.15.0",
    "build_hash": "...",
    "build_number": 1
  },
  "status": {
    "overall": {
      "since": "...",
      "level": "available",
      "summary": "All services are available"
    }
  }
}

Kibana UI Tour

Once logged in, here’s what you’ll see:

┌──────────────────────────────────────────────────┐
│                  Kibana Home                       │
│                                                    │
│  ┌────────────┐  ┌────────────┐  ┌────────────┐  │
│  │  Analytics │  │Observability│  │  Security  │  │
│  │            │  │            │  │            │  │
│  │ Discover   │  │ Logs       │  │ SIEM       │  │
│  │ Dashboard  │  │ Metrics    │  │ Endpoint   │  │
│  │ Lens       │  │ APM        │  │ Detections │  │
│  │ Canvas     │  │ Uptime     │  │            │  │
│  └────────────┘  └────────────┘  └────────────┘  │
│                                                    │
│  ┌────────────┐  ┌────────────┐                   │
│  │ Management │  │ Dev Tools  │                   │
│  │            │  │            │                   │
│  │ Stack Mgmt │  │ Console    │                   │
│  │ Fleet      │  │ (ES queries│                   │
│  │ Spaces     │  │  here)     │                   │
│  └────────────┘  └────────────┘                   │
└──────────────────────────────────────────────────┘

Important File Locations

File Path
Configuration /etc/kibana/kibana.yml
Data directory /var/lib/kibana
Log directory /var/log/kibana
Binaries /usr/share/kibana/bin/
Plugins /usr/share/kibana/plugins/

Common Issues

Issue Solution
Kibana shows “Kibana server is not ready yet” Wait 1-2 minutes for startup; check Elasticsearch is running
Cannot connect to Elasticsearch Verify elasticsearch.hosts in kibana.yml
Enrollment token expired Generate a new one with elasticsearch-create-enrollment-token -s kibana
Certificate errors Copy ES CA cert to Kibana or set elasticsearch.ssl.verificationMode: none
Port 5601 not accessible Check firewall: sudo ufw allow 5601/tcp

Quick Reference

Task Command
Start Kibana sudo systemctl start kibana
Stop Kibana sudo systemctl stop kibana
Check status sudo systemctl status kibana
View logs sudo journalctl -u kibana -f
Get verification code sudo /usr/share/kibana/bin/kibana-verification-code
Access UI http://localhost:5601
Default port 5601

Next Step

Kibana is connected to Elasticsearch! Let’s now install Logstash to process and transform log data.

You may also enjoy