Kibana Is a service for visualizing Elasticsearch data and navigating it through the Elastic Stack. It helps you create dashboards, customize the visualization form, generate interactive graphs, even present geodata, analyze relationships, and explore anomalies with machine learning.

Installing Kibana from the repository

We import the PGP Key to further add the Elasticsearch repository

$ rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

Add the repository

$ sudo nano /etc/yum.repos.d/kibana.repo
[elasticsearch]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

Install Kibana

$ sudo dnf -y install kibana

Add the Kibana service to startup and start it

$ sudo systemctl enable --now kibana

Checking if the service has started

$ systemctl status kibana

Installing Kibana from an RPM package

Download the Kibana package and install it

$ wget https://artifacts.elastic.co/downloads/kibana/kibana-7.9.3-x86_64.rpm -P /tmp
$ cd /tmp
$ sudo dnf -y localinstall kibana-7.9.3-x86_64.rpm

Add the Kibana service to startup and start it

$ sudo systemctl enable --now kibana

Checking if the service has started

$ sudo systemctl status kibana

Checking the port

$ netstat -tulnp | grep 5601

Setting up Kibana

Editing the Kibana config file

$ sudo nano /etc/kibana/kibana.yml
# Kibana is served by a back end server. This setting specifies the port to use.
server.port: 5601
# Specifies the address to which the Kibana server will bind. IP addresses and host names are both valid values.
# The default is 'localhost', which usually means remote machines will not be able to connect.
# To allow connections from remote users, set this parameter to a non-loopback address.
server.host: "192.168.1.10"
[…]

# The URLs of the Elasticsearch instances to use for all your queries.
elasticsearch.hosts: ["https://localhost:9200"]

Restarting Kibana

$ sudo systemctl restart kibana

If we use Nginx as Reverse Proxy

[…]
server.host: "localhost"
[…]

in this example, we say that the server should listen on the 192.168.1.10 interface

Firewall configuration (if we do not use nginx as reverse proxy)

Opening port 5601

$ sudo firewall-cmd --add-port=5601/tcp --permanent
$ sudo firewall-cmd --reload

Installing NGINX

Add NGINX repository

$ sudo nano /etc/yum.repos.d/nginx.repo
[nginx-stable]
name=nginx stable repo
baseurl=https://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=1
enabled=1
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

[nginx-mainline]
name=nginx mainline repo
baseurl=https://nginx.org/packages/mainline/centos/$releasever/$basearch/
gpgcheck=1
enabled=0
gpgkey=https://nginx.org/keys/nginx_signing.key
module_hotfixes=true

The stable version will be used by default. If you need a mainline version, switch

$ sudo dnf config-manager --set-enabled nginx-mainline

Install NGINX and httpd-tools

$ sudo dnf -y install nginx httpd-tools

Add the NGINX service to startup and start it

$ sudo systemctl enable --now nginx

Checking if the service has started

$ systemctl status nginx

Configuring NGINX

Disable the default config

$ cd /etc/nginx/conf.d/
$ sudo mv default.conf default.conf.disable

Create config for Kibana

$ sudo nano kibana.conf
server {
  listen      80;
  #listen      [::]:80 ipv6only=on;
  server_name _;

  auth_basic "Restricted Access";
  auth_basic_user_file /etc/nginx/.kibana-user;

  location / {
    proxy_pass https://localhost:5601/;

    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }
}

Generating a password for authorization

$ sudo htpasswd -c /etc/nginx/.kibana-user mykibana
New password: password
Re-type new password: password
Adding password for user mykibana

Restart NGINX, check the status

$ sudo systemctl reload nginx
$ systemctl status nginx

Firewall configuration

Opening port 80

$ sudo firewall-cmd --permanent --zone=public --add-service=http
$ sudo firewall-cmd --reload

See the list of rules

$ sudo firewall-cmd --list-all

We close port 5601 if it was previously opened

$ sudo firewall-cmd --permanent --zone=public --remove-port=5601/tcp
$ sudo firewall-cmd --reload

SELinux configuration

Adding a rule to the SELinux policy

$ sudo setsebool -P httpd_can_network_connect=1