How to load Filebeat dashboards into Kibana

Loading the built-in Filebeat dashboards into Kibana provides instant charts and filters for common log sources, making it easier to spot spikes, errors, and host activity without building visualizations from scratch.

Filebeat ships with a bundle of Kibana saved objects such as dashboards, visualizations, searches, and data views (index patterns). The filebeat setup --dashboards command imports these objects through the Kibana HTTP API using the setup.kibana.* settings from the Filebeat configuration.

The Kibana endpoint must be reachable from the host running Filebeat, and the configured Kibana user must have permission to import saved objects. Major versions of Filebeat and Kibana should match to avoid missing fields or broken visualizations, and reloading dashboards can replace customized saved objects that share the same IDs.

1. Set the Kibana connection details in /etc/filebeat/filebeat.yml.

   setup.kibana.host: "http://kibana.example.net:5601"
   setup.kibana.username: "elastic"
   setup.kibana.password: "password"

   Use an https:// URL when Kibana is served over TLS. Set setup.kibana.space.id to load into a non-default Kibana space.

2. Confirm the Kibana API is reachable with the configured credentials.

   $ curl -s -u elastic:password "http://kibana.example.net:5601/api/status"
   {
     "name": "d21c4106a443",
     "uuid": "23989aa2-36b3-4319-b288-2e9f82ef2923",
     "version": {
       "number": "8.12.2"
   ##### snipped #####
     },
     "status": {
       "overall": {
         "level": "available",
         "summary": "All services and plugins are available"
       }
     }
   }

3. Import the Filebeat dashboards using the Filebeat setup command.

   $ sudo filebeat setup --dashboards
   Loading dashboards (Kibana must be running and reachable)
   Loaded dashboards

   Reloading dashboards can replace customized dashboards or visualizations that share the same saved object IDs.

4. Query the Kibana Saved Objects API to confirm dashboards matching filebeat exist.

   $ curl -s -u elastic:password -H "kbn-xsrf: true" "http://kibana.example.net:5601/api/saved_objects/_find?type=dashboard&search_fields=title&search=filebeat&per_page=2"
   {
     "page": 1,
     "per_page": 2,
     "total": 76,
     "saved_objects": [
       {
         "type": "dashboard",
         "id": "6576c480-73a2-11ea-a345-f985c61fe654",
         "attributes": {
           "title": "[Filebeat GCP] Audit"
         }
   ##### snipped #####
       }
     ]
   }

   Prefix the API path with /s/<space_id> when using Kibana Spaces (for example /s/observability/api/saved_objects/_find).