For security, you grant users access to the reporting features and secure the reporting endpoints with TLS/SSL encryption. Additionally, you can install graphical packages into the operating system to enable the Kibana server to have screenshotting capabilities.

Install the reporting packagesedit

Make sure the Kibana server operating system has the appropriate packages installed for the distribution.

If you are using RHEL operating systems, install the following packages:

If you are using Ubuntu/Debian systems, install the following packages:

The reporting plugin has a built-in utility to check for common issues, such as missing dependencies. See Reporting diagnostics for more information.

Grant users access to reportingedit

When security is enabled, you grant users access to reporting features with Kibana application privileges, which allow you to create custom roles that control the spaces and applications where users generate reports.

Granting the privilege to generate reports also grants the user the privilege to view their reports in Stack Management > Reporting. Users can only access their own reports.

Grant access with the role APIedit

With Kibana application privileges enabled in Reporting, you can also use the role API to grant access to the reporting features, using All privileges, or sub-feature privileges.

POST <kibana host>:<port>/api/_security/role/custom_reporting_user
{
	"elasticsearch": {
		"cluster": [],
		"indices": [],
		"run_as": []
	},
	"kibana": [{
		"spaces": ["*"],
		"base": [],
		"feature": {
			"dashboard": ["generate_report",  
      "download_csv_report"], 
      "discover": ["generate_report"], 
			"canvas": ["generate_report"], 
			"visualize": ["generate_report"] 
		}
	}]
}

Grant users access with a Basic licenseedit

With a Basic license, you can grant users access with custom roles to reporting features with Kibana application privileges. However, with a Basic license, sub-feature privileges are unavailable. Create a role, then select All privileges for the applications where users can create reports.

With a Basic license, sub-feature application privileges are unavailable, but you can use the role API to grant access to CSV reporting features:

PUT localhost:5601/api/security/role/custom_reporting_user
{
  "elasticsearch": { "cluster": [], "indices": [], "run_as": [] },
  "kibana": [
    {
      "base": [],
      "feature": {
        "dashboard": [ "all" ], 
        "discover": [ "all" ], 
      },
      "spaces": [ "*" ]
    }
  ],
  "metadata": {} // optional
}

Grant access using an external provideredit

If you are using an external identity provider, such as LDAP or Active Directory, you can assign roles to individual users or groups of users. Role mappings are configured in config/role_mapping.yml.

For example, assign the kibana_admin and reporting_user roles to the Bill Murray user:

kibana_admin:
  - "cn=Bill Murray,dc=example,dc=com"
reporting_user:
  - "cn=Bill Murray,dc=example,dc=com"

Secure the reporting endpointsedit

To automatically generate reports with Watcher, you must configure Watcher to trust the Kibana server certificate.