Help Center/ Cloud Search Service/ User Guide/ Elasticsearch/ Accessing Elasticsearch Clusters/ Logging In to an Elasticsearch Cluster Using Kibana
Updated on 2026-01-09 GMT+08:00
View PDF
Share

Logging In to an Elasticsearch Cluster Using Kibana

Kibana is the official data visualization and exploration platform for Elasticsearch. It enables in-depth data analysis and interactive visualization. In CSS, Kibana is pre-built for each Elasticsearch cluster. You can start Kibana in one click, without installing anything. Kibana offers a comprehensive suite of dashboard features and visualization tools. It seamlessly integrates Elasticsearch's analytical capabilities, supporting the full analytics process from data exploration to actionable business insights.

CSS's Kibana supports multiple access methods. Steps needed to log in to an Elasticsearch cluster vary depending on the access method you choose. See Table 1.

Table 1 Methods for logging in to an Elasticsearch cluster through Kibana

Kibana Access Method

Constraints

Details

One-click access to Kibana from the service console

N/A

Logging In to an Elasticsearch Cluster by Accessing Kibana Through the Console

Accessing Kibana using a public IP address
  • Only clusters in security mode support Kibana access through a public IP address.
  • Kibana public network access cannot be enabled for Elasticsearch security-mode clusters created before June 2020, that is, when the feature first became available.

Logging In to an Elasticsearch Cluster by Accessing Kibana Using a Public IP Address

Accessing Kibana using a private network address

The client that accesses Kibana must be able to reach Kibana's private IP address.

Logging In to an Elasticsearch Cluster by Accessing Kibana Using a Private Network Address

Constraints on Kibana Usage

  • You can customize the username, role name, and tenant name in Kibana.
  • With an Elasticsearch 7.10.2 cluster (the image version is no earlier than 7.10.2_24.3.3_x.x.x), you can switch between Chinese and English on Kibana.

    In the upper right corner of the Kibana console, click , select a language, and confirm the language change.

Logging In to an Elasticsearch Cluster by Accessing Kibana Through the Console

  1. Log in to the CSS management console.
  2. In the navigation pane on the left, choose Clusters > Elasticsearch.
  3. In the cluster list, find the target cluster, and click Kibana in the Operation column to log in to the Kibana console.
    • Non-security cluster: The Kibana console is displayed without asking for a username and password.
    • Security cluster: Enter the username and password on the login page and click Log In to log in to the Kibana console. The default username is admin and the password is the one specified during cluster creation.
  4. After the login is successful, you can access the cluster through Kibana.

Logging In to an Elasticsearch Cluster by Accessing Kibana Using a Public IP Address

  • Only clusters in security mode support Kibana access through a public IP address.
  • Kibana public network access cannot be enabled for Elasticsearch security-mode clusters created before June 2020, that is, when the feature first became available.
  • The whitelist that controls Kibana public network access depends on whitelist support by the ELB service. After you update the whitelist, the new settings take effect immediately for new connections. For existing persistent connections using the IP addresses that have been removed from the whitelist, the new settings take effect in approximately 1 minute after these connections are disconnected.
  • If you disable Kibana public network access and then re-enable it, the public IP address for accessing Kibana may change. Exercise caution.
  1. Log in to the CSS management console.
  2. In the navigation pane on the left, choose Clusters > Elasticsearch.
  3. In the cluster list, click the name of the target cluster. The cluster information page is displayed.
  4. Choose Cluster Access > Kibana Public Network Access to check whether Kibana public network access is enabled for the cluster.
    • Yes: Go to 6.
    • No: Go to the next step.
  5. Enable Kibana public network access for the Elasticsearch cluster.
    1. On the Kibana Public Network Access page, toggle on the Kibana Public Network Access button.
    2. In the displayed Kibana Public Network Access dialog box, set the parameters.
      Table 2 Configuring public network access for Kibana

      Parameter

      Description

      Bandwidth

      Bandwidth for accessing Kibana from the public network

      Value range: 1 Mbit/s to 200 Mbit/s

      Configure Whitelist

      Control Kibana public network access using a whitelist.

      • If a whitelist is configured, only IP addresses that are on this whitelist can access the cluster's Kibana console over the public network.

        Click + Add. In the displayed text box, enter IP addresses or CIDR blocks that are allowed to access the cluster's Kibana console from the public network. Separate them using commas (,). Each value must be unique. An example of valid values: 192.168.1.1,10.0.0.0/24. Examples of invalid values: 0.0.0.0, xx.xx.xx.xx/0, 172.16.0.0-172.16.255.255, non-standard formats (e.g., 192.168.1), and duplicate values.

      • If no whitelist is configured, all public IP addresses can access the cluster's Kibana console. However, this can be a security risk and should be avoided.
    3. Click OK to confirm the settings.

    If Kibana public network access is already enabled, you can modify relevant settings.

  6. After Kibana public network access is enabled, obtain the Kibana public IP address on the Kibana Public Network Access page.
    Figure 1 Obtaining the Kibana public IP address
  7. Enter the public IP address for Kibana in the browser address box to go to the Kibana login page.

    Enter the username and password on the login page and click Log In to log in to the Kibana console. The default username is admin and the password is the one specified during cluster creation.

  8. After the login is successful, you can access the Elasticsearch cluster through Kibana.

Logging In to an Elasticsearch Cluster by Accessing Kibana Using a Private Network Address

The client that accesses Kibana must be able to reach Kibana's private IP address.

  1. Log in to the CSS management console.
  2. In the navigation pane on the left, choose Clusters > Elasticsearch.
  3. In the cluster list, click the name of the target cluster. The cluster information page is displayed.
  4. Select the Overview tab. In the Network Information area, record Private IPv4 Address.
  5. Obtain Kibana's private IP address.

    By changing the port number in the cluster's private IP address from 9200 to 5601, you get Kibana's private IP address. For example, if the cluster's private IPv4 address is xx.xx.xx.xx:9200, the private IP address of Kibana is xx.xx.xx.xx:5601.

  6. (Optional) Configure a return route. To enable a client to access the cluster's Kibana console across different VPCs, configure a route for the Elasticsearch cluster.
    1. Connect the client and Kibana through a Direct Connect or VPC peering connection.
    2. Configure the route connecting the Elasticsearch cluster and the client.

      On the Overview tab, find Cluster Route in the Network Information area, and click Add Route under it. In the displayed dialog box, set IP Address and Subnet Mask.

    For details, see Configuring Routes for an Elasticsearch Cluster.

  7. Access Kibana.
    • If the security mode is enabled for an Elasticsearch cluster, the Kibana access address is https://{Kibana private network address}, for example, https://xx.xx.xx.xx:5601.
    • If the security mode is disabled, the Kibana access address is http://{Kibana private network address}, for example, http://xx.xx.xx.xx:5601.

Configuring a Custom Kibana Base Path

For multi-cluster management, the default root path access method of Kibana may not meet security authentication and request verification requirements. CSS allows you to configure a custom Base Path for Kibana. This allows you to set a dedicated access path for each cluster to implement fine-grained access control, simplify multi-cluster management, and improve overall system security.

You can configure a custom base path in either of the following ways:

  • Method 1 (recommended): Modify Base Path on the CSS console.

    This method is not affected by the cluster version or your current account.

  • Method 2: Modify Base Path on the Kibana console.

    Only the cluster administrator admin under Global Tenant has the permission to configure a custom Kibana Base Path, which applies globally.

    The cluster version must be 7.10.2 and the image version must be 7.10.2_24.3.3_x.x.x or later.

Procedure for Method 1

  1. Log in to the CSS management console.
  2. In the navigation pane on the left, choose Clusters > Elasticsearch.
  3. In the cluster list, click the name of the target cluster. The cluster information page is displayed.
  4. Choose Cluster Settings > Parameter Settings > Kibana.
  5. Click Edit, and set the parameters.
    Table 3 Configuring Base Path

    Parameter

    Description

    server.basePath

    Custom value for Base Path.

    When you need to access Kibana through a reverse proxy (such as Nginx), this value is appended to the proxy address as a subpath. For example, if the reverse proxy address is http://example.com and server.basePath is set to /test, you can access Kibana through the address http://example.com/test.

    The value can be:
    • Must start with /.
    • Must not contain consecutive slashes (for example, //).
    • Can only contain letters, digits, hyphens (-), underscores (_), periods (.), and slashes (/).
    • Can contain multi-level paths, but its length cannot exceed 254 characters.
    • Must not end with a slash (/).

    server.rewriteBasePath

    Whether Kibana or a reverse proxy will remove the server.basePath prefix from the request path.

    This parameter is optional. If no reverse proxy is used, ignore this parameter.

    The value can be:
    • true: Kibana will automatically remove the server.basePath prefix from the request path.
    • false: The reverse proxy (such as Nginx) will remove the server.basePath prefix from the request path. In this case, you can only access Kibana through the reverse proxy.

    The default value is false. The default value can only be changed for Elasticsearch clusters no earlier than 6.5.4.
  6. After the change is complete, click Save. In the displayed dialog box, confirm the settings, and select "Modifying Kibana settings will restart Kibana, making it temporarily inaccessible." Then click OK.

    If Job Status is Succeeded in the parameter settings task list below, the change is successful. Up to 1000 modification records can be displayed.

  7. Access Kibana.
    • Access Kibana through the Kibana private network address.
      • When the security mode is enabled for the Elasticsearch cluster, and server.rewriteBasePath is true, the internal and external addresses of Kibana are https://{Kibana private network address}{server.basePath}, for example, https://xx.xx.xx.xx:5601/test.
      • When the security mode is enabled for the Elasticsearch cluster, and server.rewriteBasePath is false, Kibana can only be accessed through a reverse proxy.
      • When the security mode is disabled for the Elasticsearch cluster, and server.rewriteBasePath is true, Kibana can only be accessed from the internal network, and its address is http://{Kibana private network address}{server.basePath}, for example, http://xx.xx.xx.xx:5601/test.
      • When the security mode is disabled for the Elasticsearch cluster, and server.rewriteBasePath is false, Kibana can only be accessed through a reverse proxy.
    • Access Kibana through the Kibana public network address (when Kibana public network access is enabled).
      • When server.rewriteBasePath is set to true, the public network address of Kibana is https://{Kibana public network address}{server.basePath}, for example, https://xx.xx.xx.xx:5601/test.
      • When server.rewriteBasePath is set to false, Kibana can only be accessed through a reverse proxy.
    • Access Kibana through the reverse proxy server address.

      The Kibana address is http://{reverse proxy server address}{server.basePath}, for example, http://xx.xx.xx.xx:port/test. Support for public network access depends on whether the reverse proxy server uses a public IP address. This solution also depends on the reverse proxy server configuration.

Procedure for Method 2

  1. Log in to the CSS management console.
  2. In the navigation pane on the left, choose Clusters > Elasticsearch.
  3. In the cluster list, find the target cluster, and click Kibana in the Operation column to log in to the Kibana console using the administrator account.
    • Username: admin (default administrator account)
    • Password: Enter the administrator password you set when creating the cluster in security mode.
  4. After a successful login, choose Stack Management in the left navigation pane of the Kibana console.
  5. Choose Advanced Settings on the left of the Stack Management page.
  6. On the Settings page, set Base Path Alias. The value must start with a slash (/) and must not end with one. A multi-layer path is allowed, but its length cannot exceed 255 characters.
    Figure 2 Custom Base Path
  7. Click Save changes. The saved changes take effect in approximately 10 seconds.
  8. Access Kibana.
    • Access Kibana through the Kibana private network address.
      • When the security mode is enabled for the Elasticsearch cluster, the internal and external addresses of Kibana are https://{Kibana private network address}{Base Path Alias}, for example, https://xx.xx.xx.xx:5601/test.
      • When the security mode is disabled for the Elasticsearch cluster, Kibana can only be accessed from the internal network, and its address is http://{Kibana private network address}{Base Path Alias}, for example, http://xx.xx.xx.xx:5601/test.
    • Access Kibana through the Kibana public network address (when Kibana public network access is enabled).

      The public network address for Kibana is https://{Kibana public access address}{Base Path Alias}, for example, https://xx.xx.xx.xx:5601/test.

Related Documents