How to connect Kibana to Elasticsearch

Connecting Kibana to Elasticsearch is what lets the web UI load saved objects, query indices, build dashboards, and run alerting or monitoring tasks. When the backend endpoint or credentials are wrong, Kibana usually stalls at Kibana server is not ready yet, reports a degraded status, or keeps restarting without ever becoming usable.

On package-based Linux installs, Kibana reads outbound cluster settings from /etc/kibana/kibana.yml and secure values from its own kibana.keystore. elasticsearch.hosts names the Elasticsearch HTTP endpoint, elasticsearch.username plus elasticsearch.password uses the internal kibana_system user, and elasticsearch.serviceAccountToken is the service-account alternative for secured clusters.

Fresh secured installations can use an Elasticsearch enrollment token instead of manual editing. The kibana-setup tool and first-start browser enrollment flow write the Elasticsearch connection settings automatically; manual configuration is still needed when the token has expired, the endpoint has moved, or an existing host must be repaired. Keep passwords and tokens out of /etc/kibana/kibana.yml, trust the Elasticsearch HTTP CA when HTTPS is used, and restart Kibana after changing either the file or keystore.

1. Confirm the Elasticsearch HTTP endpoint from the Kibana host.

   $ curl --silent --show-error http://elasticsearch.example.net:9200/_cluster/health?pretty
   {
     "cluster_name" : "production-search",
     "status" : "green",
     "number_of_nodes" : 3,
     "active_shards" : 42,
     "unassigned_shards" : 0
   }

   For secured HTTPS endpoints, add --user elastic and --cacert /etc/kibana/certs/http-ca.crt or the equivalent trust path before editing Kibana.

2. Open the Kibana configuration file for editing.

   $ sudoedit /etc/kibana/kibana.yml

   Archive or container installs commonly use a different config path such as /usr/share/kibana/config/kibana.yml.

3. Set elasticsearch.hosts to the Elasticsearch HTTP endpoint or endpoints that Kibana should use.

   elasticsearch.hosts: ["https://es.example.net:9200"]

   All listed URLs must belong to the same Elasticsearch cluster. A load balancer URL is also valid when it fronts the cluster's HTTP API.

4. Set the server-side authentication method for Kibana.

   elasticsearch.username: "kibana_system"

   The kibana_system user is for Kibana server maintenance, not browser login. For service-account authentication, leave elasticsearch.username unset and store elasticsearch.serviceAccountToken in the keystore instead.

5. Store the matching secret in the Kibana keystore.

   $ sudo -u kibana env KBN_PATH_CONF=/etc/kibana /usr/share/kibana/bin/kibana-keystore add elasticsearch.password
   Enter value for elasticsearch.password: ********

   Use elasticsearch.serviceAccountToken instead of elasticsearch.password when the previous step uses service-account authentication. Remove matching plain-text secrets from /etc/kibana/kibana.yml after the value is stored.
   Related: How to add a secret to a Kibana keystore
   Related: How to create a Kibana keystore

6. Trust the Elasticsearch certificate authority when elasticsearch.hosts uses HTTPS.

   elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/certs/http-ca.crt"]

   Keep elasticsearch.ssl.verificationMode at its default full whenever possible. Setting it to none disables certificate validation and allows a man-in-the-middle to impersonate Elasticsearch.

7. Restart the Kibana service so it reloads the updated connection settings.

   $ sudo systemctl restart kibana

   Related: How to manage the Kibana service with systemctl in Linux

8. Check the Kibana service state after the restart.

   $ sudo systemctl status kibana --no-pager --full
   ● kibana.service - Kibana
        Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; preset: enabled)
        Active: active (running) since Thu 2026-04-02 14:18:45 UTC; 7s ago
          Docs: https://www.elastic.co
      Main PID: 8123 (node)
         Tasks: 11 (limit: 28486)
        Memory: 1007.4M (peak: 1.3G)
           CPU: 14.242s
   ##### snipped #####

   Use sudo journalctl –unit=kibana –no-pager -n 50 when the service stays in a restart loop or never reaches active (running).
   Related: How to manage the Kibana service with systemctl in Linux

9. Query the Kibana status API to confirm both overall readiness and the Elasticsearch core connection.

   $ curl --silent --show-error http://localhost:5601/api/status | jq '{overall: .status.overall.level, elasticsearch: .status.core.elasticsearch.level}'
   {
     "overall": "available",
     "elasticsearch": "available"
   }

   Use --user elastic or an Authorization header instead of placing a password in the command. Add the configured server.basePath prefix, HTTPS URL, or CA trust option when Kibana is not served from plain http://localhost:5601.
   Related: How to check Kibana status
   Related: How to configure the Kibana base path