137 lines
5.6 KiB
Text
137 lines
5.6 KiB
Text
[[production]]
|
|
== Using Kibana in a Production Environment
|
|
* <<configuring-kibana-shield, Configuring Kibana to Work with Shield>>
|
|
* <<enabling-ssl, Enabling SSL>>
|
|
* <<controlling-access, Controlling Access>>
|
|
* <<load-balancing, Load Balancing Across Multiple Elasticsearch Nodes>>
|
|
|
|
How you deploy Kibana largely depends on your use case. If you are the only user,
|
|
you can run Kibana on your local machine and configure it to point to whatever
|
|
Elasticsearch instance you want to interact with. Conversely, if you have a large
|
|
number of heavy Kibana users, you might need to load balance across multiple
|
|
Kibana instances that are all connected to the same Elasticsearch instance.
|
|
|
|
While Kibana isn't terribly resource intensive, we still recommend running Kibana
|
|
separate from your Elasticsearch data or master nodes. To distribute Kibana
|
|
traffic across the nodes in your Elasticsearch cluster, you can run Kibana
|
|
and an Elasticsearch client node on the same machine. For more information, see
|
|
<<load-balancing, Load Balancing Across Multiple Elasticsearch Nodes>>.
|
|
|
|
[float]
|
|
[[configuring-kibana-shield]]
|
|
=== Configuring Kibana to Work with Shield
|
|
If you are using Shield to authenticate Elasticsearch users, you need to provide
|
|
the Kibana server with credentials so it can access the `.kibana` index and monitor
|
|
the cluster.
|
|
|
|
To configure credentials for the Kibana server:
|
|
|
|
. Assign the `kibana4_server` role to a user in Shield. For more information, see
|
|
{shield}/kibana.html#kibana4-server-role[Configuring a Role for the Kibana 4 Server]
|
|
in the Shield documentation.
|
|
|
|
. Set the `kibana_elasticsearch_username` and
|
|
`kibana_elasticsearch_password` properties in `kibana.yml` to specify the credentials
|
|
of the user you assigned the `kibana4_server`
|
|
role:
|
|
+
|
|
[source,text]
|
|
----
|
|
kibana_elasticsearch_username: kibana4-user
|
|
kibana_elasticsearch_password: kibana4-password
|
|
----
|
|
|
|
Kibana 4 users also need access to the `.kibana` index so they can save and load searches, visualizations, and dashboards.
|
|
For more information, see {shield}/kibana.html#kibana4-server-role[Configuring Roles for Kibana 4 Users] in
|
|
the Shield documentation.
|
|
|
|
TIP: See <<kibana-dynamic-mapping, Kibana and Elasticsearch Dynamic Mapping>> for important information on Kibana and
|
|
the dynamic mapping feature in Elasticsearch.
|
|
|
|
[float]
|
|
[[enabling-ssl]]
|
|
=== Enabling SSL
|
|
Kibana supports SSL encryption for both client requests and the requests the Kibana server
|
|
sends to Elasticsearch.
|
|
|
|
To encrypt communications between the browser and the Kibana server, you configure the `ssl_key_file `and
|
|
`ssl_cert_file` properties in `kibana.yml`:
|
|
|
|
[source,text]
|
|
----
|
|
# SSL for outgoing requests from the Kibana Server (PEM formatted)
|
|
ssl_key_file: /path/to/your/server.key
|
|
ssl_cert_file: /path/to/your/server.crt
|
|
----
|
|
|
|
If you are using Shield or a proxy that provides an HTTPS endpoint for Elasticsearch,
|
|
you can configure Kibana to access Elasticsearch via HTTPS so communications between
|
|
the Kibana server and Elasticsearch are encrypted.
|
|
|
|
To do this, you specify the HTTPS
|
|
protocol when you configure the Elasticsearch URL in `kibana.yml`:
|
|
|
|
[source,text]
|
|
----
|
|
elasticsearch: "https://<your_elasticsearch_host>.com:9200"
|
|
----
|
|
|
|
If you are using a self-signed certificate for Elasticsearch, set the `ca` property in
|
|
`kibana.yml` to specify the location of the PEM file. Setting the `ca` property lets you leave the `verify_ssl` option enabled.
|
|
|
|
[source,text]
|
|
----
|
|
# If you need to provide a CA certificate for your Elasticsearch instance, put
|
|
# the path of the pem file here.
|
|
ca: /path/to/your/ca/cacert.pem
|
|
----
|
|
|
|
[float]
|
|
[[controlling-access]]
|
|
=== Controlling access
|
|
You can use http://www.elastic.co/overview/shield/[Elasticsearch Shield]
|
|
(Shield) to control what Elasticsearch data users can access through Kibana.
|
|
Shield provides index-level access control. If a user isn't authorized to run
|
|
the query that populates a Kibana visualization, the user just sees an empty
|
|
visualization.
|
|
|
|
To configure access to Kibana using Shield, you create Shield roles
|
|
for Kibana using the `kibana4` default role as a starting point. For more
|
|
information, see {shield}/kibana.html#using-kibana4-with-shield[Shield with Kibana 4][Using Shield with Kibana 4].
|
|
|
|
[float]
|
|
[[load-balancing]]
|
|
=== Load Balancing Across Multiple Elasticsearch Nodes
|
|
If you have multiple nodes in your Elasticsearch cluster, the easiest way to distribute Kibana requests
|
|
across the nodes is to run an Elasticsearch _client_ node on the same machine as Kibana.
|
|
Elasticsearch client nodes are essentially smart load balancers that are part of the cluster. They
|
|
process incoming HTTP requests, redirect operations to the other nodes in the cluster as needed, and
|
|
gather and return the results. For more information, see
|
|
http://www.elastic.co/guide/en/elasticsearch/reference/current/modules-node.html[Node] in the Elasticsearch reference.
|
|
|
|
To use a local client node to load balance Kibana requests:
|
|
|
|
. Install Elasticsearch on the same machine as Kibana.
|
|
. Configure the node as a client node. In `elasticsearch.yml`, set both `node.data` and `node.master` to `false`:
|
|
+
|
|
--------
|
|
# 3. You want this node to be neither master nor data node, but
|
|
# to act as a "search load balancer" (fetching data from nodes,
|
|
# aggregating results, etc.)
|
|
#
|
|
node.master: false
|
|
node.data: false
|
|
--------
|
|
. Configure the client node to join your Elasticsearch cluster. In `elasticsearch.yml`, set the `cluster.name` to the
|
|
name of your cluster.
|
|
+
|
|
--------
|
|
cluster.name: "my_cluster"
|
|
--------
|
|
. Make sure Kibana is configured to point to your local client node. In `kibana.yml`, the `elasticsearch_url` should be set to
|
|
`localhost:9200`.
|
|
+
|
|
--------
|
|
# The Elasticsearch instance to use for all your queries.
|
|
elasticsearch_url: "http://localhost:9200"
|
|
--------
|