Logging In to an Elasticsearch Cluster Using Kibana

Constraints on Kibana Usage

• You can customize the username, role name, and tenant name in Kibana.
• With an Elasticsearch 7.10.2 cluster (the image version is no earlier than 7.10.2_24.3.3_x.x.x), you can switch between Chinese and English on Kibana.

  In the upper right corner of the Kibana console, click , select a language, and confirm the language change.

Logging In to an Elasticsearch Cluster by Accessing Kibana Through the Console

1. Log in to the CSS management console.
2. In the navigation pane on the left, choose Clusters > Elasticsearch to show the Elasticsearch cluster list.
3. Find the target cluster, and click Kibana in the Operation column. The Kibana login page is displayed.
   • Non-security cluster: The Kibana console is displayed without asking for a username and password.
   • Security cluster: Enter the username and password on the login page and click Log In to log in to the Kibana console. The default username is admin and the password is the one specified during cluster creation.
4. After the login is successful, you can access the cluster through Kibana.

Logging In to an Elasticsearch Cluster by Accessing Kibana Using a Public IP Address

• Only clusters in security mode support Kibana access through a public IP address.
• Kibana public network access cannot be enabled for Elasticsearch security-mode clusters created before June 2020, that is, when the feature first became available.
• The whitelist that controls Kibana public network access depends on whitelist support by the ELB service. After you update the whitelist, the new settings take effect immediately for new connections. For existing persistent connections using the IP addresses that have been removed from the whitelist, the new settings take effect in approximately 1 minute after these connections are disconnected.

• If you disable Kibana public network access and then re-enable it, the public IP address for accessing Kibana may change. Exercise caution.

1. Log in to the CSS management console.
2. In the navigation pane on the left, choose Clusters > Elasticsearch to show the Elasticsearch cluster list.
3. In the cluster list, click the target cluster name to go to the Cluster Information page.
4. In the left navigation pane, choose Kibana Public Network Access, and check whether Kibana Public Network Access is enabled.
   • Yes: Go to 6.
   • No: Go to the next step.
5. Enable Kibana public network access for the Elasticsearch cluster.
   1. On the Kibana Public Network Access page, toggle on the Kibana Public Network Access button.
   2. In the displayed dialog box, set the parameters.

      Table 2 Enabling Kibana public network access

      Parameter	Description
      Bandwidth	Bandwidth for accessing Kibana from the public network Value range: 1 Mbit/s to 200 Mbit/s Default value: 1 Mbit/s
      Access Control	Whether to enable access control. Enable (recommended): Only IP addresses or CIDR blocks on a pre-configured whitelist can access the cluster's Kibana console from the public network. Disable (default): All public IP addresses can access the cluster through Kibana.
      Whitelist	Enter IP addresses or CIDR blocks that are allowed to access the cluster's Kibana console from the public network. Separate them using commas (,). Each value must be unique. An example of valid values: 192.168.1.1,10.0.0.0/24. Examples of invalid values: 0.0.0.0, x.x.x.x0, 172.16.0.0-172.16.255.255, non-standard formats (e.g., 192.168.1), and duplicate values. This parameter can be configured only when Access Control is enabled. NOTE: The whitelist that controls Kibana public network access depends on whitelist support by the ELB service. After you update the whitelist, the new settings take effect immediately for new connections. For existing persistent connections using the IP addresses that have been removed from the whitelist, the new settings take effect in approximately 1 minute after these connections are disconnected.

6. After Kibana public network access is enabled, obtain the Kibana public IP address on the Kibana Public Network Access page.
   Figure 1 Obtaining the Kibana public IP address
   
7. Enter the public IP address for Kibana in the browser address box to go to the Kibana login page.
   • Non-security cluster: The Kibana console is displayed without asking for a username and password.
   • Security cluster: Enter the username and password on the login page and click Log In to log in to the Kibana console. The default username is admin and the password is the one specified during cluster creation.
8. After the login is successful, you can access the Elasticsearch cluster through Kibana.

Logging In to an Elasticsearch Cluster by Accessing Kibana Using a Private Network Address

Only servers in the same VPC can access Kibana using a private network address of the Elasticsearch cluster.

1. Log in to the CSS management console.
2. In the navigation pane on the left, choose Clusters > Elasticsearch to show the Elasticsearch cluster list.
3. In the cluster list, click the target cluster name to go to the Cluster Information page.
4. On the Cluster Information page, obtain the cluster's private network address.
   Figure 2 Obtaining the cluster's private IP address
   
5. Obtain Kibana's private IP address.

   By changing the port number in the cluster's private IP address from 9200 to 5601, you get Kibana's private IP address. For example, if the cluster's private IPv4 address is 192.168.0.***:9200, the private IP address of Kibana is 192.168.0.***:5601.

6. (Optional) Configure a return route. To enable a client to access the cluster's Kibana console across different networks, configure a route for the Elasticsearch cluster.
   1. Connect the client and Kibana through a Direct Connect or VPC peering connection.
   2. Configure the route connecting the Elasticsearch cluster and the client.

      On the Cluster Information page, find Cluster Route, and click Add Route on the right. In the displayed dialog box, set IP Address and Subnet Mask.

   For details, see Configuring Routes for an Elasticsearch Cluster.

7. On the client, enter the private network address of Kibana to go to the Kibana login page.
   • Non-security cluster: The Kibana console is displayed without asking for a username and password.
   • Security cluster: Enter the username and password on the login page and click Log In to log in to the Kibana console. The default username is admin and the password is the one specified during cluster creation.
8. After the login is successful, you can access the Elasticsearch cluster through Kibana.

More: Configuring a Custom Kibana Base Path for Public Network Access

With Elasticsearch 7.10.2, you can configure a custom Base Path for Kibana access after Kibana public network access is enabled. Or you can use the default Kibana Base Path instead.

• This feature is available for Elasticsearch 7.10.2 clusters (the image version is no earlier than 7.10.2_24.3.3_x.x.x) for which Kibana public network access is enabled.
• Only the cluster administrator admin under Global Tenant has the permission to configure a custom Kibana Base Path, which applies globally.

1. Log in to the CSS management console.
2. In the navigation pane on the left, choose Clusters > Elasticsearch to show the Elasticsearch cluster list.
3. Choose Clusters > Elasticsearch in the navigation pane. On the Clusters page, locate the target cluster and click Access Kibana in the Operation column.
4. Log in to Kibana using an administrator account.
   • Username: admin (default administrator account)
   • Password: Enter the administrator password you set when creating the cluster in security mode.
5. After a successful login, choose Stack Management in the left navigation pane of the Kibana console.
6. Choose Advanced Settings on the left of the Stack Management page.
7. On the Settings page, set Base Path Alias. The value must start with a slash (/) and must not end with one. A multi-layer path is allowed, but its length cannot exceed 255 characters.
   Figure 3 Custom Base Path
   
8. Click Save changes. The saved changes take effect in approximately 10 seconds.
9. Access Kibana using the Kibana public network address plus Base Path Alias.

   For example, if the Kibana public network address of the Elasticsearch cluster is https://xx.xx.xx.xx:5601 and the configured Base Path Alias is /test, you can access Kibana via https://xx.xx.xx.xx:5601/test from the public network.

Related Documents

• For details about how to use in-house developed Kibana to access Elasticsearch clusters in CSS, see How Do I Connect In-house Developed Kibana to an Elasticsearch Cluster in CSS?
• If Kibana cannot be launched, see Failed to Open Kibana.
• For routine O&M tasks (such as shard adjustment, index management, and performance monitoring), you are advised to use Cerebro for cluster login. For details, see Logging In to an Elasticsearch Cluster Through Cerebro.