IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Secure saved objects Configure logging »

› ›

Configure reporting in Kibana

edit

Configure reporting in Kibana

edit

For security, you grant users access to the reporting features and secure the reporting endpoints with TLS/SSL encryption. Additionally, you can install graphical packages into the operating system to enable the Kibana server to have screenshotting capabilities.

Install the reporting packages

edit

Make sure the Kibana server operating system has the appropriate packages installed for the distribution.

If you are using RHEL operating systems, install the following packages:

ipa-gothic-fonts
xorg-x11-fonts-100dpi
xorg-x11-fonts-75dpi
xorg-x11-utils
xorg-x11-fonts-cyrillic
xorg-x11-fonts-Type1
xorg-x11-fonts-misc
fontconfig
freetype

If you are using Ubuntu/Debian systems, install the following packages:

fonts-liberation
libfontconfig1
libnss3

The reporting plugin has a built-in utility to check for common issues, such as missing dependencies. See Reporting diagnostics for more information.

Grant users access to reporting

edit

When security is enabled, you grant users access to reporting features with Kibana application privileges, which allow you to create custom roles that control the spaces and applications where users generate reports.

Enable application privileges in Reporting. To enable, turn off the default user access control features in kibana.yml:
```
xpack.reporting.roles.enabled: false
```
If you use the default settings, you can still create a custom role that grants reporting privileges. The default role is reporting_user. This behavior is being deprecated and does not allow application-level access controls for reporting features, and does not allow API keys or authentication tokens to authorize report generation. Refer to reporting security settings for information and caveats about the deprecated access control features.
Create the reporting role.
1. Open the main menu, then click Stack Management.
2. Click Roles > Create role.
Specify the role settings.
1. Enter the Role name. For example, custom_reporting_user.
2. Specify the Indices and Privileges.
  
  Access to data is an index-level privilege. For each index that contains the data you want to include in reports, add a line, then give each index read and view_index_metadata privileges.
  
  If you use index aliases, you must also grant read and view_index_metadata privileges to underlying indices to generate CSV reports.
  
  For more information, refer to Security privileges.
Add the Kibana privileges.
1. Click Add Kibana privilege.
2. Select one or more Spaces.
3. Click Customize, then click Analytics.
4. For each application, select All, or to customize the privileges, select Read and Customize sub-feature privileges.
  
  If you have a Basic license, sub-feature privileges are unavailable. For details, check out Grant users access with a Basic license.
  
  If the Reporting options for application features are unavailable, and the cluster license is higher than Basic, contact your administrator, or check that xpack.reporting.roles.enabled is set to false in kibana.yml.
5. Click Add Kibana privilege.
Click Create role.
Assign the reporting role to a user.
1. Open the main menu, then click Stack Management.
2. Click Users, then click the user you want to assign the reporting role to.
3. From the Roles dropdown, select custom_reporting_user.
4. Click Update user.

Granting the privilege to generate reports also grants the user the privilege to view their reports in Stack Management > Reporting. Users can only access their own reports.

Grant access with the role API

edit

With Kibana application privileges enabled in Reporting, you can also use the role API to grant access to the reporting features, using All privileges, or sub-feature privileges.

this [API request](https://www.elastic.co/guide/en/kibana/current/role-management-api-put.html) needs to be executed against the Kibana API endpoint

POST <kibana host>:<port>/api/_security/role/custom_reporting_user
{
	"elasticsearch": {
		"cluster": [],
		"indices": [],
		"run_as": []
	},
	"kibana": [{
		"spaces": ["*"],
		"base": [],
		"feature": {
			"dashboard": ["generate_report",  
      "download_csv_report"], 
      "discover": ["generate_report"], 
			"canvas": ["generate_report"], 
			"visualize": ["generate_report"] 
		}
	}]
}

	Grants access to generate PNG and PDF reports in Dashboard.
	Grants access to download CSV files from saved search panels in Dashboard.
	Grants access to generate CSV reports from saved searches in Discover.
	Grants access to generate PDF reports in Canvas.
	Grants access to generate PNG and PDF reports in Visualize Library.

Grant users access with a Basic license

edit

With a Basic license, you can grant users access with custom roles to reporting features with Kibana application privileges. However, with a Basic license, sub-feature privileges are unavailable. Create a role, then select All privileges for the applications where users can create reports.

Kibana privileges with Reporting options, Basic license

With a Basic license, sub-feature application privileges are unavailable, but you can use the role API to grant access to CSV reporting features:

PUT localhost:5601/api/security/role/custom_reporting_user
{
  "elasticsearch": { "cluster": [], "indices": [], "run_as": [] },
  "kibana": [
    {
      "base": [],
      "feature": {
        "dashboard": [ "all" ], 
        "discover": [ "all" ], 
      },
      "spaces": [ "*" ]
    }
  ],
  "metadata": {} // optional
}

	Grants access to generate CSV reports from saved searches in Discover.
	Grants access to download CSV reports from saved search panels in Dashboard.

Grant access using an external provider

edit

If you are using an external identity provider, such as LDAP or Active Directory, you can assign roles to individual users or groups of users. Role mappings are configured in config/role_mapping.yml.

For example, assign the kibana_admin and reporting_user roles to the Bill Murray user:

kibana_admin:
  - "cn=Bill Murray,dc=example,dc=com"
reporting_user:
  - "cn=Bill Murray,dc=example,dc=com"

Secure the reporting endpoints

edit

To automatically generate reports with Watcher, you must configure Watcher to trust the Kibana server certificate.

Enable Elastic Stack security features on your Elasticsearch cluster. For more information, see Getting started with security.
Configure TLS/SSL encryption for the Kibana server. For more information, see Encrypt TLS communications in Kibana.
Specify the Kibana server CA certificate chain in elasticsearch.yml:

If you are using your own CA to sign the Kibana server certificate, then you need to specify the CA certificate chain in Elasticsearch to properly establish trust in TLS connections between Watcher and Kibana. If your CA certificate chain is contained in a PKCS #12 trust store, specify it like so:
```
xpack.http.ssl.truststore.path: "/path/to/your/truststore.p12"
xpack.http.ssl.truststore.type: "PKCS12"
xpack.http.ssl.truststore.password: "optional decryption password"
```
Otherwise, if your CA certificate chain is in PEM format, specify it like so:
```
xpack.http.ssl.certificate_authorities: ["/path/to/your/cacert1.pem", "/path/to/your/cacert2.pem"]
```
For more information, see the Watcher HTTP TLS/SSL Settings.
Add one or more users who have access to the reporting features.

Once you’ve enabled SSL for Kibana, all requests to the reporting endpoints must include valid credentials.

« Secure saved objects Configure logging »