Configure reporting in Kibana

For security, you grant users access to the reporting features and secure the reporting endpoints with TLS/SSL encryption. Additionally, you can install graphical packages into the operating system to enable the Kibana server to have screenshotting capabilities.

When security is enabled, you grant users access to reporting features with Kibana application privileges, which allow you to create custom roles that control the spaces and applications where users generate reports.

Granting the privilege to generate reports also grants the user the privilege to view their reports in Stack Management > Reporting. Users can only access their own reports.

With Kibana application privileges enabled in Reporting, you can also use the role API to grant access to the reporting features, using All privileges, or sub-feature privileges.

PUT <kibana host>:<port>/api/security/role/custom_reporting_user
{
	"elasticsearch": {
		"cluster": [],
		"indices": [],
		"run_as": []
	},
	"kibana": [{
		"spaces": ["*"],
		"base": [],
		"feature": {
			"dashboard": ["generate_report",  
      "download_csv_report"], 
      "discover": ["generate_report"], 
			"canvas": ["generate_report"], 
			"visualize": ["generate_report"] 
		}
	}]
}

With a Basic license, you can grant users access with custom roles to reporting features with Kibana application privileges. However, with a Basic license, sub-feature privileges are unavailable. Create a role, then select All privileges for the applications where users can create reports.

With a Basic license, sub-feature application privileges are unavailable, but you can use the role API to grant access to CSV reporting features:

PUT localhost:5601/api/security/role/custom_reporting_user
{
  "elasticsearch": { "cluster": [], "indices": [], "run_as": [] },
  "kibana": [
    {
      "base": [],
      "feature": {
        "dashboard": [ "all" ], 
        "discover": [ "all" ], 
      },
      "spaces": [ "*" ]
    }
  ],
  "metadata": {} // optional
}

If you are using an external identity provider, such as LDAP or Active Directory, you can assign roles to individual users or groups of users. Role mappings are configured in config/role_mapping.yml.

For example, assign the kibana_admin and reporting_user roles to the Bill Murray user:

kibana_admin:
  - "cn=Bill Murray,dc=example,dc=com"
reporting_user:
  - "cn=Bill Murray,dc=example,dc=com"

To automatically generate reports with Watcher, you must configure Watcher to trust the Kibana server certificate.

For more information on sharing reports, direct links, and more, refer to Reporting and sharing.

If using PNG/PDF reporting features, make sure the Kibana server operating system has the appropriate packages installed for the distribution.

If you are using RHEL operating systems, install the following packages:

If you are using Ubuntu/Debian systems, install the following packages:

The screenshotting plugin used for {reporting-features} has a built-in utility to check for common issues, such as missing dependencies. See Reporting diagnostics for more information.

If using PNG/PDF reporting features in a production environment, it is preferred to use the setting of server.host: 0.0.0.0 in the kibana.yml configuration file. This allows the headless browser used for PDF/PNG reporting to reach Kibana over a local interface, while also allowing the Kibana server to listen on outward-facing network interfaces, as it makes the Kibana server accessible from any network interface on the machine. Make sure that no firewall rules or other routing rules prevent local services from accessing this address.

For the most reliable configuration of PDF/PNG reporting features, consider installing Kibana using Docker, or using Elastic Cloud.