How to install Kibana on CentOS, RHEL, or Fedora

Installing Kibana on CentOS, RHEL, or Fedora provides a browser-based interface for exploring Elasticsearch data, building dashboards, and using the Elastic apps for logs, metrics, and alerting.

The RPM package installs Kibana under /usr/share/kibana, stores configuration in /etc/kibana/kibana.yml, writes runtime data under /var/lib/kibana and /var/log/kibana, and registers a kibana.service unit that serves the web UI on port 5601.

Current Elastic RPM guidance uses a dedicated 9.x repository, and Kibana should use the same version as the connected Elasticsearch cluster. Secure first-time setups commonly use an enrollment token, while remote browser access still requires an explicit server.host change and any matching firewall allowance.

Steps to install Kibana on CentOS, RHEL, or Fedora:

Import the Elastic signing key for RPM packages.
```
$ sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
```
No output indicates the key was imported successfully.

Create the Kibana repository file at /etc/yum.repos.d/kibana.repo.

[kibana-9.x]
name=Kibana repository for 9.x packages
baseurl=https://artifacts.elastic.co/packages/9.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

Use yum instead of dnf on older CentOS and legacy RHEL systems.

Install the Kibana package from the repository.
```
$ sudo dnf install --assumeyes kibana
Installing:
  kibana-9.3.2-1.x86_64
Complete!
```
The architecture suffix changes with the host, so aarch64 systems show aarch64 instead of x86_64.
Set the public bind address in /etc/kibana/kibana.yml when remote browser access is required.
```
server.host: "0.0.0.0"
```
Binding to 0.0.0.0 exposes port 5601 to any reachable network, so pair it with a firewall, reverse proxy, or VPN before allowing untrusted access.
Add a permanent firewalld rule for TCP port 5601 when remote access is required.
```
$ sudo firewall-cmd --permanent --add-port=5601/tcp
success
```
Skip this step when firewalld is not installed or when Kibana stays on localhost behind another access layer.
Reload firewalld to apply the new rule.
```
$ sudo firewall-cmd --reload
success
```
Generate a fresh enrollment token for Kibana on an Elasticsearch node when the initial token is unavailable or has expired.
```
$ sudo /usr/share/elasticsearch/bin/elasticsearch-create-enrollment-token -s kibana
eyJ2ZXIiOiI5LjMuMiIsImFkciI6WyJodHRwczovL2VzLmV4YW1wbGUubmV0OjkyMDAiXSwiZmdyIjoiOTQ1Yz##### snipped #####
```
Install the same 9.3.2 stack version on both Kibana and Elasticsearch. Add --url "https://<es-host>:9200" if the token tool must reach a non-default local HTTP endpoint.
Enroll Kibana in detached mode with the enrollment token on the Kibana host.
```
$ sudo /usr/share/kibana/bin/kibana-setup --enrollment-token "<enrollment-token>"
Kibana has been configured successfully.
```
The detached setup path is useful before the first long-running service start or when the browser-based first-start flow is not practical.
Reload systemd units after the package install.
```
$ sudo systemctl daemon-reload
```

Enable and start the Kibana service.

$ sudo systemctl enable --now kibana
Created symlink /etc/systemd/system/multi-user.target.wants/kibana.service -> /usr/lib/systemd/system/kibana.service.

Verify the Kibana service is running.

$ sudo systemctl status kibana --no-pager --full | head -n 12
● kibana.service - Kibana
     Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-04-02 14:18:45 UTC; 9s ago
       Docs: https://www.elastic.co
   Main PID: 8123 (node)
      Tasks: 11 (limit: 28486)
     Memory: 1007.4M (peak: 1.3G)
        CPU: 14.242s
##### snipped #####

Use journalctl –unit=kibana –no-pager -n 50 if the unit never reaches active (running) or keeps restarting.

Open the Kibana web UI in a browser.
```
http://<kibana-host>:5601
```
Sign in with the current elastic password or another Elasticsearch user that has Kibana access.