ELK Stack — Reporting and Spaces

5 minute read

Introduction

In production environments, stakeholders need scheduled reports delivered to their inbox, and teams need isolated workspaces where they can manage their own dashboards without stepping on each other. Kibana’s Reporting and Spaces features address both needs.

Reporting lets you export dashboards and saved searches as CSV, PDF, or PNG files — on demand or on a schedule. Spaces provide logical isolation within a single Kibana instance, giving each team its own set of dashboards, saved objects, and feature visibility.

Reporting

Report Types

Format Source Use Case
CSV Saved search in Discover Raw data export for spreadsheets or data pipelines
PDF Dashboard or Canvas workpad Visual snapshot for executives or compliance
PNG Dashboard or visualization Image for embedding in wikis or Slack

Generating a CSV Report

  1. Open Discover
  2. Run your query and select the columns you need
  3. Save the search (e.g., Prod Errors — Last 24h)
  4. Click Share → CSV Reports → Generate CSV
  5. Kibana queues the report — download from Stack Management → Reporting

CSV options:

  • Maximum row limit is configurable via xpack.reporting.csv.maxSizeBytes
  • Large exports are streamed to avoid memory issues
  • Timestamps are exported in ISO 8601 format

Generating a PDF Report

  1. Open a Dashboard or Canvas workpad
  2. Click Share → PDF Reports
  3. Choose layout:
    • Preserve layout — matches the current browser viewport
    • Print optimized — standard paper layout
  4. Click Generate PDF
  5. Download from Stack Management → Reporting

Generating a PNG Report

  1. Open a Dashboard or Visualization
  2. Click Share → PNG Reports
  3. Click Generate PNG
  4. Download from Stack Management → Reporting

Scheduling Reports

Kibana does not have a built-in report scheduler in the UI, but you can schedule reports using the Reporting API combined with a cron job or alerting rule.

Report API — Generate a CSV

curl -X POST "https://localhost:5601/api/reporting/v1/generate/csv_searchsource" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u elastic:changeme \
  -d '{
    "searchSource": {
      "index": "data-view-id-here",
      "query": { "query": "log.level: ERROR", "language": "kuery" },
      "fields": ["@timestamp", "message", "host.name"],
      "sort": [{ "@timestamp": "desc" }]
    },
    "columns": ["@timestamp", "message", "host.name"],
    "title": "Daily Error Report"
  }'

The API returns a path to poll for report completion:

{
  "path": "/api/reporting/jobs/download/abc123",
  "job": {
    "id": "abc123",
    "status": "pending"
  }
}

Report API — Generate a PDF

curl -X POST "https://localhost:5601/api/reporting/generate/printablePdfV2" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u elastic:changeme \
  -d '{
    "locatorParams": [{
      "id": "DASHBOARD_APP_LOCATOR",
      "params": {
        "dashboardId": "your-dashboard-id",
        "timeRange": { "from": "now-24h", "to": "now" }
      }
    }],
    "layout": {
      "id": "preserve_layout",
      "dimensions": { "width": 1920, "height": 1080 }
    },
    "title": "Daily Platform Dashboard"
  }'

Report API — Check Status and Download

# Check status
curl -X GET "https://localhost:5601/api/reporting/jobs/download/abc123" \
  -H "kbn-xsrf: true" \
  -u elastic:changeme

# Download when complete
curl -X GET "https://localhost:5601/api/reporting/jobs/download/abc123" \
  -H "kbn-xsrf: true" \
  -u elastic:changeme \
  -o report.pdf

Scheduling with Cron

Create a shell script that generates and downloads a report, then schedule it:

#!/bin/bash
# generate-daily-report.sh

KIBANA_URL="https://localhost:5601"
CREDENTIALS="elastic:changeme"

# Trigger report generation
RESPONSE=$(curl -s -X POST "${KIBANA_URL}/api/reporting/generate/printablePdfV2" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u "${CREDENTIALS}" \
  -d '{
    "locatorParams": [{"id":"DASHBOARD_APP_LOCATOR","params":{"dashboardId":"dashboard-id","timeRange":{"from":"now-24h","to":"now"}}}],
    "layout": {"id":"preserve_layout","dimensions":{"width":1920,"height":1080}},
    "title": "Daily Report"
  }')

JOB_PATH=$(echo "${RESPONSE}" | jq -r '.path')

# Poll until complete
while true; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
    "${KIBANA_URL}${JOB_PATH}" -u "${CREDENTIALS}")
  if [ "${STATUS}" = "200" ]; then
    curl -s "${KIBANA_URL}${JOB_PATH}" -u "${CREDENTIALS}" -o "/tmp/daily-report-$(date +%F).pdf"
    break
  fi
  sleep 10
done

Add to crontab:

# Run daily at 07:00 UTC
0 7 * * * /opt/scripts/generate-daily-report.sh

Spaces

What are Spaces?

Spaces are logical partitions within a single Kibana instance. Each Space has:

  • Its own set of saved objects (dashboards, visualizations, data views, saved searches)
  • Configurable feature visibility (hide features teams don’t need)
  • A unique URL prefix
  • Independent default index pattern

Default Space

Every Kibana instance has a Default space. All saved objects created before Spaces was enabled live here. The Default space cannot be deleted.

Creating a Space

  1. Open Stack Management → Spaces
  2. Click Create a space
  3. Configure:
    • Name: Platform Engineering
    • URL Identifier: platform (auto-generated from name)
    • Description: Dashboards and alerts for the platform team
    • Initials / Color: Choose for visual identification
  4. Under Customize features, toggle off features this team doesn’t need:
    • Example: Disable Machine Learning, Canvas, Graph for a team that only needs Discover and Dashboards
  5. Click Create space

Space URL Structure

Each Space has a unique URL prefix:

Space URL Pattern
Default https://kibana.example.com/app/discover
Platform https://kibana.example.com/s/platform/app/discover
Security https://kibana.example.com/s/security/app/discover

The /s/<space-id>/ prefix is automatically applied.

Space-Level Feature Visibility

Control which Kibana apps are available in each space:

Feature Platform Team Security Team Executive
Discover ✅ ✅ ❌
Dashboard ✅ ✅ ✅
Canvas ❌ ❌ ✅
Maps ❌ ✅ ❌
Machine Learning ❌ ✅ ❌
Alerting ✅ ✅ ❌
Dev Tools ✅ ❌ ❌

This reduces clutter and prevents accidental modifications.

Copying Saved Objects Between Spaces

You can copy dashboards, visualizations, and other saved objects from one Space to another.

Via the UI

  1. Open Stack Management → Saved Objects
  2. Select the objects to copy (e.g., a dashboard and its dependent visualizations)
  3. Click Copy to space
  4. Select the target space(s)
  5. Choose how to handle conflicts:
    • Skip — don’t overwrite existing objects with the same ID
    • Overwrite — replace existing objects
    • Create new copies — create with new IDs
  6. Click Copy

Via the API

curl -X POST "https://localhost:5601/api/spaces/_copy_saved_objects" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u elastic:changeme \
  -d '{
    "spaces": ["platform", "security"],
    "objects": [
      { "type": "dashboard", "id": "my-dashboard-id" }
    ],
    "includeReferences": true,
    "overwrite": false,
    "createNewCopies": false
  }'

Setting includeReferences: true ensures all dependent visualizations, data views, and saved searches are copied along with the dashboard.

Managing Spaces via API

List All Spaces

curl -X GET "https://localhost:5601/api/spaces/space" \
  -H "kbn-xsrf: true" \
  -u elastic:changeme

Create a Space

curl -X POST "https://localhost:5601/api/spaces/space" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u elastic:changeme \
  -d '{
    "id": "data-science",
    "name": "Data Science",
    "description": "ML and analytics workspace",
    "disabledFeatures": ["siem", "canvas", "maps"]
  }'

Delete a Space

curl -X DELETE "https://localhost:5601/api/spaces/space/data-science" \
  -H "kbn-xsrf: true" \
  -u elastic:changeme

Warning: Deleting a Space permanently removes all saved objects within it.

Real-World Spaces Architecture

A company with multiple teams sets up Spaces as follows:

Space Teams Features Enabled Dashboards
Default Admins All System monitoring
platform Platform / SRE Discover, Dashboard, Alerting, Dev Tools Infrastructure health
security SecOps Discover, Dashboard, Maps, ML, Alerting SIEM dashboards
app-team-a App Team A Discover, Dashboard Application logs
executive Leadership Dashboard, Canvas Business KPIs

Each team sees only their own dashboards and relevant features. RBAC (covered next) controls who can access which Space.

Quick Reference

Task Method
Generate CSV Discover → Share → CSV Reports
Generate PDF Dashboard → Share → PDF Reports
Generate PNG Dashboard → Share → PNG Reports
Report API (CSV) POST /api/reporting/v1/generate/csv_searchsource
Report API (PDF) POST /api/reporting/generate/printablePdfV2
Schedule reports Combine Report API with cron or alerting
Create a Space Stack Management → Spaces → Create
Copy objects Saved Objects → Select → Copy to space
Copy objects API POST /api/spaces/_copy_saved_objects
Delete a Space DELETE /api/spaces/space/<id>
Space URL pattern /s/<space-id>/app/<app-name>

Next: RBAC →

You may also enjoy