How to set the Kibana public base URL

Setting the public base URL keeps links generated by Kibana pointed at the address users actually open in a browser, instead of an internal hostname, a local bind address, or a reverse-proxy backend.

Kibana reads server.publicBaseUrl from /etc/kibana/kibana.yml at startup and uses it when features need an absolute link back to the interface. Current Elastic documentation still requires the value to include the protocol, any non-default port, and the full server.basePath when a base path is configured.

Kibana validates this setting during startup. In a current lab, a value that omitted the configured base path or added a trailing slash caused a fatal configuration error before the HTTP service finished starting, so the URL in server.publicBaseUrl must match the real external path exactly.

1. Identify the exact browser URL that end users open for Kibana.

   Examples: https://kibana.example.net
   https://kibana.example.net/kibana when server.basePath is /kibana
   https://kibana.example.net:8443/kibana when the published URL uses a non-default port.

2. Back up the current Kibana configuration before changing it.

   $ sudo cp /etc/kibana/kibana.yml /etc/kibana/kibana.yml.bak

3. Open the Kibana configuration file in a root-owned editor.

   $ sudoedit /etc/kibana/kibana.yml

   Docker and archive installs commonly use /usr/share/kibana/config/kibana.yml instead of /etc/kibana/kibana.yml.

4. Set server.publicBaseUrl to the exact published URL.

   server.publicBaseUrl: "https://kibana.example.net/kibana"

   Include http:// or https://, include the port when it is not 80 or 443, and include the full server.basePath when one is configured.

   Do not add a trailing / after the final path segment. Current Kibana startup validation rejects https://kibana.example.net/kibana/ when the base path is /kibana.

5. Restart the Kibana service to load the updated setting.

   $ sudo systemctl restart kibana

   Related: How to manage the Kibana service with systemctl in Linux

6. Confirm the kibana service returned to an active state after the restart.

   $ sudo systemctl status kibana --no-pager --full | head -n 12
   ● kibana.service - Kibana
        Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; preset: enabled)
        Active: active (running) since Thu 2026-01-08 00:22:45 UTC; 12min ago
          Docs: https://www.elastic.co
      Main PID: 57170 (node)
         Tasks: 11 (limit: 28486)
        Memory: 1011.9M (peak: 1.4G)
           CPU: 34.864s
   ##### snipped #####

   If the service does not return to active (running), inspect the journal immediately. Current Kibana releases fail fast when server.publicBaseUrl does not contain the configured server.basePath.

7. Request the published URL to confirm Kibana answers under the same path used in server.publicBaseUrl.

   $ curl -sSI https://kibana.example.net/kibana/ | head -n 6
   HTTP/1.1 200 OK
   x-content-type-options: nosniff
   referrer-policy: strict-origin-when-cross-origin
   permissions-policy: camera=(), display-capture=(), fullscreen=(self), geolocation=(), microphone=(), web-share=()
   content-type: text/html; charset=utf-8
   cache-control: private, no-cache, no-store, must-revalidate

   An HTML response, a redirect to the login page, or other normal Kibana headers all confirm that the published URL is answering on the expected path.

8. Check recent Kibana logs if startup or the published URL test fails.

   $ sudo journalctl --unit=kibana --since "5 minutes ago" --no-pager | rg -m 3 -n "publicBaseUrl|FATAL"

   Configuration errors are usually reported before the HTTP server finishes starting.