Kibana 8.x Deployment Guide
Create User
sudo useradd kibana
Downloda Package
wget https://artifacts.elastic.co/downloads/kibana/kibana-8.10.4-linux-x86_64.tar.gz
tar -zxf kibana-8.10.4-linux-x86_64.tar.gz
sudo mv kibana-8.10.4 /opt/kibana
sudo chown -R kibana:kibana /opt/kibana
Connect to Elasticsearhc with Credentials
Besides the token-based connection, Kibana can also authenticate using a username and password. Configure as follows.
Generate Password for kibana_system User
# Run on an ES node
cd /usr/share/elasticsearch/bin
sudo ./elasticsearch-reset-password -u kibana_system
# Follow the prompt
# Example output: New value: 5tR_8eKmLJVp0QJj9=T2
Modify Kibana Configuration
cat /opt/kibana/config/kibana.yml
server.host: "0.0.0.0"
#server.publicBaseUrl: "https://kibana.example.com:5601" # For domain access
elasticsearch.hosts: ['https://es-node1:9200','https://es-node2:9200','https://es-node3:9200']
elasticsearch.username: kibana_system
elasticsearch.password: 5tR_8eKmLJVp0QJj9=T2 # Generated password
elasticsearch.ssl.verificationMode: none
i18n.locale: "zh-CN" # Set to Chinese
Start with systemd
sudo vi /etc/systemd/system/kibana.service
[Unit]
Description=Kibana
Documentation=https://www.elastic.co
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
User=kibana
Group=kibana
PrivateTmp=true
Environment=KBN_HOME=/opt/kibana
Environment=KBN_PATH_CONF=/opt/kibana/config
ExecStart=/opt/kibana/bin/kibana
Restart=on-failure
RestartSec=3
StartLimitBurst=3
StartLimitInterval=60
WorkingDirectory=/opt/kibana
StandardOutput=journal
StandardError=inherit
[Install]
WantedBy=multi-user.target
sudo systemctl daemon-reload
sudo systemctl enable kibana --now
Verify Login
Enable HTTPS
By default Kibana uses HTTP. For production environments HTTPS is recommended. You can either obtain a public TLS certificate or use self‑signed certificates generated by Elasticsearch tools.
Generate Kibana Certificate and Private Key
# Run on an ES node
cd /usr/share/elasticsearch/bin
sudo ./elasticsearch-certutil csr -name kibana-server -dns kibana.example.com,localhost
# Press Enter to accept defaults
The output bundle is located at /usr/share/elasticsearch/csr-bundle.zip.
Copy Certificate to Kibana
sudo unzip /usr/share/elasticsearch/csr-bundle.zip -d /opt/kibana/
# Rename folder if needed, e.g.:
sudo mv /opt/kibana/kibana-server /opt/kibana/certs
Genearte CRT File
cd /opt/kibana/certs
sudo openssl x509 -req -in kibana-server.csr -signkey kibana-server.key -out kibana-server.crt
# Verify files:
ls -la
# Should list: kibana-server.crt, kibana-server.csr, kibana-server.key
Update Kibana Configuration
cat /opt/kibana/config/kibana.yml
server.host: "0.0.0.0"
server.ssl.enabled: true
server.ssl.certificate: /opt/kibana/certs/kibana-server.crt
server.ssl.key: /opt/kibana/certs/kibana-server.key
elasticsearch.hosts: ['https://es-node1:9200','https://es-node2:9200','https://es-node3:9200']
elasticsearch.username: kibana_system
elasticsearch.password: 5tR_8eKmLJVp0QJj9=T2
elasticsearch.ssl.verificationMode: none
i18n.locale: "zh-CN"
Restart Kibana
sudo systemctl restart kibana.service
Access Verification
