Kibana setup and connection in Elasticsearch - Step-by-Step Execution

Concept Flow - Kibana setup and connection

Start Kibana Service

↓

Kibana listens on port 5601

↓

User opens browser at localhost:5601

↓

Kibana sends request to Elasticsearch

↓

Elasticsearch responds with data

↓

Kibana displays data in dashboard

↓

End

This flow shows how Kibana starts, listens for user requests, connects to Elasticsearch, and displays data.

Execution Sample

Elasticsearch

sudo systemctl start kibana
curl -X GET "localhost:9200"
curl -X GET "localhost:5601/api/status"

Starts Kibana service, checks Elasticsearch is running, then checks Kibana status.

Execution Table

Step	Action	Command/Request	Response/Result
1	Start Kibana service	sudo systemctl start kibana	Kibana service started successfully
2	Check Elasticsearch is running	curl -X GET "localhost:9200"	{"name":"node-1","cluster_name":"elasticsearch"}
3	Check Kibana status	curl -X GET "localhost:5601/api/status"	{"status":"green","message":"Kibana is running"}
4	Open Kibana in browser	Open http://localhost:5601	Kibana UI loads, ready to use
5	Kibana requests data	Kibana sends query to Elasticsearch	Elasticsearch returns data
6	Display data	Kibana renders dashboard	User sees visualized data
7	Exit	User closes browser or stops Kibana	Kibana service stops or session ends

💡 User ends session or stops Kibana service

Variable Tracker

Variable	Before Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	Final
Kibana Service	Stopped	Running	Running	Running	Running	Running	Running	Stopped or Running
Elasticsearch	Unknown	Unknown	Running	Running	Running	Running	Running	Running
User Browser	Closed	Closed	Closed	Open at 5601	Open at 5601	Open at 5601	Open at 5601	Closed or Open
Data Flow	None	None	None	None	Request Sent	Data Received	Displayed	None or Displayed

Key Moments - 3 Insights

Why do we check Elasticsearch status before checking Kibana?

Because Kibana depends on Elasticsearch to get data, so Elasticsearch must be running first (see execution_table step 2).

What happens if Kibana service is not started?

Kibana UI won't load in the browser and status check will fail (see execution_table step 3).

Why do we open the browser at port 5601?

Because Kibana listens on port 5601 by default to serve its web interface (see concept_flow).

Visual Quiz - 3 Questions

Look at the execution_table, what is the response when checking Elasticsearch status at step 2?

A Kibana service started successfully

B {"status":"green","message":"Kibana is running"}

C {"name":"node-1","cluster_name":"elasticsearch"}

D User sees visualized data

💡 Hint

Check the 'Response/Result' column in execution_table row for step 2.

At which step does the user open the Kibana UI in the browser?

A Step 4

B Step 1

C Step 3

D Step 6

💡 Hint

Look for the 'Open Kibana in browser' action in execution_table.

If Elasticsearch is not running, what will happen to the Kibana status check at step 3?

A It will show Kibana is running normally

B It will fail or show error because Kibana can't connect to Elasticsearch

C Kibana will start automatically Elasticsearch

D Nothing changes, Kibana works offline

💡 Hint

Refer to key_moments about dependency between Kibana and Elasticsearch.

Concept Snapshot

Kibana setup and connection:
- Start Kibana service (default port 5601)
- Ensure Elasticsearch is running (default port 9200)
- Open browser at localhost:5601
- Kibana queries Elasticsearch for data
- Data is visualized in Kibana UI
- Stop services when done

Full Transcript

This visual execution shows how to set up and connect Kibana to Elasticsearch. First, start the Kibana service. Then check that Elasticsearch is running by sending a request to its port 9200. Next, check Kibana status via its API on port 5601. Open the browser at localhost:5601 to load the Kibana interface. Kibana sends queries to Elasticsearch and receives data. Finally, Kibana displays the data in dashboards. The session ends when the user closes the browser or stops Kibana. Key points include starting Elasticsearch before Kibana and using the correct ports. The execution table tracks each step's commands and responses, while the variable tracker shows the state of services and data flow. The quiz tests understanding of these steps and dependencies.

Practice

1. What is the main requirement before starting Kibana to ensure it works properly?

easy

A. The browser must be Internet Explorer

B. Kibana must be installed on a different server

C. Elasticsearch must be running

D. A database connection must be configured

Solution

1. Step 1: Understand Kibana's dependency

   Kibana is a visualization tool that requires Elasticsearch to provide data.

2. Step 2: Confirm service requirement

   Without Elasticsearch running, Kibana cannot fetch or display data.

3. Final Answer:

   Elasticsearch must be running -> Option C

4. Quick Check:

   Kibana needs Elasticsearch running [OK]

Hint: Remember: Kibana shows data from Elasticsearch only [OK]

Common Mistakes:

• Thinking Kibana works standalone without Elasticsearch
• Confusing Kibana with a database
• Assuming any browser works without checking compatibility

2. Which setting in kibana.yml specifies the Elasticsearch server address?

easy

A. elasticsearch.hosts

B. server.port

C. kibana.index

D. logging.dest

Solution

1. Step 1: Identify configuration purpose

   The kibana.yml file configures Kibana settings including connection details.

2. Step 2: Locate Elasticsearch host setting

   The setting elasticsearch.hosts defines the URL(s) of Elasticsearch nodes Kibana connects to.

3. Final Answer:

   elasticsearch.hosts -> Option A

4. Quick Check:

   Elasticsearch server address = elasticsearch.hosts [OK]

Hint: Look for 'elasticsearch.hosts' in kibana.yml [OK]

Common Mistakes:

• Confusing server.port with Elasticsearch address
• Using kibana.index which is for saved objects
• Mistaking logging.dest for connection settings

3. Given the following kibana.yml snippet:

elasticsearch.hosts: ["http://localhost:9200"]
server.port: 5601

What URL should you open in your browser to access Kibana?

medium

A. http://localhost:9200

B. http://localhost:9200/kibana

C. http://localhost:5601/elasticsearch

D. http://localhost:5601

Solution

1. Step 1: Identify Kibana server port

   The setting server.port: 5601 means Kibana listens on port 5601.

2. Step 2: Determine correct URL

   To access Kibana, open the browser at http://localhost:5601. Port 9200 is for Elasticsearch, not Kibana.

3. Final Answer:

   http://localhost:5601 -> Option D

4. Quick Check:

   Kibana URL uses server.port = 5601 [OK]

Hint: Kibana runs on server.port, default 5601 [OK]

Common Mistakes:

• Opening Elasticsearch port 9200 instead of Kibana port
• Appending /kibana or /elasticsearch incorrectly
• Confusing ports between services

4. You started Kibana but get a connection error. Which of these is the most likely cause?

medium

A. Elasticsearch service is not running

B. Kibana is running on port 9200

C. Browser cache is full

D. Kibana.yml file is missing

Solution

1. Step 1: Understand connection error cause

   Kibana depends on Elasticsearch; if Elasticsearch is down, Kibana cannot connect.

2. Step 2: Evaluate other options

   Kibana does not run on port 9200 (Elasticsearch default). Browser cache or missing config file usually cause different errors.

3. Final Answer:

   Elasticsearch service is not running -> Option A

4. Quick Check:

   Connection error = Elasticsearch down [OK]

Hint: Check Elasticsearch service status first [OK]

Common Mistakes:

• Assuming Kibana runs on Elasticsearch port
• Blaming browser cache for connection errors
• Ignoring Elasticsearch service status

5. You want to connect Kibana to a remote Elasticsearch server at http://192.168.1.100:9200. Which is the correct elasticsearch.hosts setting in kibana.yml?

hard

A. elasticsearch.hosts: ["http://localhost:9200"]

B. elasticsearch.hosts: ["http://192.168.1.100:9200"]

C. elasticsearch.hosts: "192.168.1.100:5601"

D. elasticsearch.hosts: ["https://192.168.1.100:5601"]

Solution

1. Step 1: Identify remote Elasticsearch URL

   The remote server address is http://192.168.1.100:9200, which is the default Elasticsearch port.

2. Step 2: Set elasticsearch.hosts correctly

   The setting must be a list with the full URL including protocol and port: ["http://192.168.1.100:9200"].

3. Step 3: Eliminate incorrect options

   elasticsearch.hosts: ["http://localhost:9200"] points to localhost, not remote. Options C and D use wrong ports or protocols for Elasticsearch.

4. Final Answer:

   elasticsearch.hosts: ["http://192.168.1.100:9200"] -> Option B

5. Quick Check:

   Remote Elasticsearch URL in elasticsearch.hosts list [OK]

Hint: Use full URL with http and port 9200 in elasticsearch.hosts [OK]

Common Mistakes:

• Using localhost instead of remote IP
• Omitting protocol (http://)
• Using wrong port like 5601 for Elasticsearch