Enable and configure Kibana audit logging for saved object access, logins, and space operations. Use when setting up Kibana audit, filtering events, or correlating Kibana and ES audit logs.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Enable and configure Kibana audit logging for saved object access, logins, and space operations. Use when setting up Kibana audit, filtering events, or correlating Kibana and ES audit logs.
metadata
{"author":"elastic","version":"0.1.0"}
Kibana Audit Logging
Enable and configure audit logging for Kibana via kibana.yml. Kibana audit logs cover application-layer security
events that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases),
login/logout, session expiry, space operations, and Kibana-level RBAC enforcement.
For Elasticsearch audit logging (authentication failures, access grants/denials, security config changes), see
elasticsearch-audit. For authentication and API key management, see elasticsearch-authn. For roles and user
management, see elasticsearch-authz.
To disable, set xpack.security.audit.enabled to false and restart Kibana.
Appender types
Type
Description
rolling-file
Writes to a file with rotation policy. Recommended.
console
Writes to stdout. Useful for containerized deployments.
Event Types
Kibana audit events use ECS format with the same core fields as ES audit (event.action, event.outcome, user.name,
trace.id, @timestamp) plus Kibana-specific fields like kibana.saved_object.type, kibana.saved_object.id, and
kibana.space_id.
An event is filtered out if it matches all specified fields within a single filter entry.
Correlate with Elasticsearch Audit Logs
When Kibana makes requests to Elasticsearch on behalf of a user, both systems record the same trace.id (passed via the
X-Opaque-Id header). This is the primary key for correlating events across the two audit logs.
Prerequisite: Elasticsearch audit must be enabled via the cluster settings API. See the elasticsearch-audit
skill for setup instructions, event types, and ES-specific filter policies.
Correlation workflow
Find the suspicious event in the Kibana audit log.
Extract its trace.id value.
Search the ES audit index (.security-audit-*) for all events with the same trace.id.
Review the combined timeline to understand what ES-level operations the Kibana action triggered.
The elasticsearch-audit skill also documents this workflow from the ES side — use it when starting from an ES audit
event and looking for the originating Kibana action.
Search ES audit by trace ID
Given a suspicious Kibana event (e.g. a saved object deletion), extract its trace.id and search the ES audit index:
Request: "Someone deleted a dashboard. Check the Kibana audit log."
Search the Kibana audit log (or the indexed kibana-audit-* data) for saved_object_delete events with
kibana.saved_object.type: dashboard. Extract the trace.id and cross-reference with the ES audit index to see the
underlying Elasticsearch operations.
Reduce audit noise from saved object searches
Request: "Kibana audit logs are too large because of constant saved_object_find events."
This suppresses high-volume read operations while preserving create, update, and delete events.
Guidelines
Always enable alongside Elasticsearch audit
For full coverage, enable audit in both kibana.yml and Elasticsearch. Without Kibana audit, saved object access and
Kibana login events are invisible. Without ES audit, cluster-level operations are invisible. See the
elasticsearch-audit skill for ES-side setup.
Use trace.id for correlation
When investigating a Kibana event, always extract trace.id and search the ES audit index (.security-audit-*). This
reveals the full chain of operations triggered by a single Kibana action. See
Correlate with Elasticsearch Audit Logs above for queries.
Filter noisy read events
saved_object_find generates very high volume on busy Kibana instances. Suppress it unless you specifically need to
audit read access.
Ship logs to Elasticsearch for unified querying
Kibana audit logs are written to files by default. Ship them to Elasticsearch via Filebeat for programmatic querying
alongside ES audit events.
Rotate and retain appropriately
Configure rolling-file rotation to avoid filling the disk. A 30-90 day retention is typical for compliance.
Deployment Compatibility
Capability
Self-managed
ECH
Serverless
Kibana audit (kibana.yml)
Yes
Via Cloud UI
Not available
Rolling-file appender
Yes
Via Cloud UI
Not available
Console appender
Yes
Yes
Not available
Ignore filters
Yes
Via Cloud UI
Not available
Correlate via trace.id
Yes
Yes
Not available
Ship to ES via Filebeat
Yes
Yes
Not available
ECH notes: Kibana audit is enabled via the deployment edit page in the Cloud console. Log files are accessible
through the Cloud console deployment logs.
Serverless notes:
Kibana audit logging is not user-configurable on Serverless. Security events are managed by Elastic as part of the
platform.
If a user asks about Kibana auditing on Serverless, direct them to the Elastic Cloud console or their account team.
