mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 09:48:58 -04:00
Add acnchors to Kibana docs-settings (#78115)
* Add acnchors to Kibana docs-settings * Address PR comments
This commit is contained in:
PavithraCP
GitHub
parent
934d53384c
commit
180827cfe1
6 changed files with 106 additions and 104 deletions
|
|
@ -33,7 +33,7 @@ For more information, see
|
|||
|===
|
||||
| `monitoring.enabled`
|
||||
| Set to `true` (default) to enable the {monitor-features} in {kib}. Unlike the
|
||||
`monitoring.ui.enabled` setting, when this setting is `false`, the
|
||||
<<monitoring-ui-enabled, `monitoring.ui.enabled`>> setting, when this setting is `false`, the
|
||||
monitoring back-end does not run and {kib} stats are not sent to the monitoring
|
||||
cluster.
|
||||
|
||||
|
|
@ -44,7 +44,7 @@ a|`monitoring.cluster_alerts.`
|
|||
|
||||
| `monitoring.ui.elasticsearch.hosts`
|
||||
| Specifies the location of the {es} cluster where your monitoring data is stored.
|
||||
By default, this is the same as `elasticsearch.hosts`. This setting enables
|
||||
By default, this is the same as <<elasticsearch-hosts, `elasticsearch.hosts`>>. This setting enables
|
||||
you to use a single {kib} instance to search and visualize data in your
|
||||
production cluster as well as monitor data sent to a dedicated monitoring
|
||||
cluster.
|
||||
|
|
@ -58,7 +58,7 @@ a|`monitoring.cluster_alerts.`
|
|||
cluster uses the authenticated user's credentials, which must be the same on
|
||||
both the {es} monitoring cluster and the {es} production cluster. +
|
||||
+
|
||||
If not set, {kib} uses the value of the `elasticsearch.username` setting.
|
||||
If not set, {kib} uses the value of the <<elasticsearch-user-passwd, `elasticsearch.username`>> setting.
|
||||
|
||||
| `monitoring.ui.elasticsearch.password`
|
||||
| Specifies the password used by {kib} monitoring to establish a persistent connection
|
||||
|
|
@ -69,11 +69,11 @@ a|`monitoring.cluster_alerts.`
|
|||
cluster uses the authenticated user's credentials, which must be the same on
|
||||
both the {es} monitoring cluster and the {es} production cluster. +
|
||||
+
|
||||
If not set, {kib} uses the value of the `elasticsearch.password` setting.
|
||||
If not set, {kib} uses the value of the <<elasticsearch-user-passwd, `elasticsearch.password`>> setting.
|
||||
|
||||
| `monitoring.ui.elasticsearch.pingTimeout`
|
||||
| Specifies the time in milliseconds to wait for {es} to respond to internal
|
||||
health checks. By default, it matches the `elasticsearch.pingTimeout` setting,
|
||||
health checks. By default, it matches the <<elasticsearch-pingTimeout, `elasticsearch.pingTimeout`>> setting,
|
||||
which has a default value of `30000`.
|
||||
|
||||
|===
|
||||
|
|
@ -112,7 +112,7 @@ about configuring {kib}, see
|
|||
| Specifies the number of log entries to display in *{stack-monitor-app}*.
|
||||
Defaults to `10`. The maximum value is `50`.
|
||||
|
||||
| `monitoring.ui.enabled`
|
||||
|[[monitoring-ui-enabled]] `monitoring.ui.enabled`
|
||||
| Set to `false` to hide *{stack-monitor-app}*. The monitoring back-end
|
||||
continues to run as an agent for sending {kib} stats to the monitoring
|
||||
cluster. Defaults to `true`.
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ You can configure `xpack.reporting` settings in your `kibana.yml` to:
|
|||
| [[xpack-enable-reporting]]`xpack.reporting.enabled` {ess-icon}
|
||||
| Set to `false` to disable the {report-features}.
|
||||
|
||||
| `xpack.reporting.encryptionKey` {ess-icon}
|
||||
|[[xpack-reporting-encryptionKey]] `xpack.reporting.encryptionKey` {ess-icon}
|
||||
| Set to an alphanumeric, at least 32 characters long text string. By default, {kib} will generate a random key when it
|
||||
starts, which will cause pending reports to fail after restart. Configure this
|
||||
setting to preserve the same key across multiple restarts and multiple instances of {kib}.
|
||||
|
|
@ -53,20 +53,20 @@ proxy host requires that the {kib} server has network access to the proxy.
|
|||
[cols="2*<"]
|
||||
|===
|
||||
| `xpack.reporting.kibanaServer.port`
|
||||
| The port for accessing {kib}, if different from the `server.port` value.
|
||||
| The port for accessing {kib}, if different from the <<server-port, `server.port`>> value.
|
||||
|
||||
| `xpack.reporting.kibanaServer.protocol`
|
||||
| The protocol for accessing {kib}, typically `http` or `https`.
|
||||
|
||||
| `xpack.reporting.kibanaServer.hostname`
|
||||
| The hostname for accessing {kib}, if different from the `server.host` value.
|
||||
|[[xpack-kibanaServer-hostname]] `xpack.reporting.kibanaServer.hostname`
|
||||
| The hostname for accessing {kib}, if different from the <<server-host, `server.host`>> value.
|
||||
|
||||
|===
|
||||
|
||||
[NOTE]
|
||||
============
|
||||
Reporting authenticates requests on the Kibana page only when the hostname matches the
|
||||
`xpack.reporting.kibanaServer.hostname` setting. Therefore Reporting would fail if the
|
||||
<<xpack-kibanaServer-hostname, `xpack.reporting.kibanaServer.hostname`>> setting. Therefore Reporting would fail if the
|
||||
set value redirects to another server. For that reason, `"0"` is an invalid setting
|
||||
because, in the Reporting browser, it becomes an automatic redirect to `"0.0.0.0"`.
|
||||
============
|
||||
|
|
@ -97,8 +97,8 @@ reports, you might need to change the following settings.
|
|||
[NOTE]
|
||||
============
|
||||
Running multiple instances of {kib} in a cluster for load balancing of
|
||||
reporting requires identical values for `xpack.reporting.encryptionKey` and, if
|
||||
security is enabled, `xpack.security.encryptionKey`.
|
||||
reporting requires identical values for <<xpack-reporting-encryptionKey, `xpack.reporting.encryptionKey`>> and, if
|
||||
security is enabled, <<xpack-security-encryptionKey, `xpack.security.encryptionKey`>>.
|
||||
============
|
||||
|
||||
[cols="2*<"]
|
||||
|
|
@ -177,7 +177,7 @@ available, but there will likely be errors in the visualizations in the report.
|
|||
[[reporting-chromium-settings]]
|
||||
==== Chromium settings
|
||||
|
||||
When `xpack.reporting.capture.browser.type` is set to `chromium` (default) you can also specify the following settings.
|
||||
When <<xpack-reporting-browser, `xpack.reporting.capture.browser.type`>> is set to `chromium` (default) you can also specify the following settings.
|
||||
|
||||
[cols="2*<"]
|
||||
|===
|
||||
|
|
@ -246,7 +246,7 @@ a| `xpack.reporting.capture.browser`
|
|||
| Reporting uses a weekly index in {es} to store the reporting job and
|
||||
the report content. The index is automatically created if it does not already
|
||||
exist. Configure this to a unique value, beginning with `.reporting-`, for every
|
||||
{kib} instance that has a unique `kibana.index` setting. Defaults to `.reporting`.
|
||||
{kib} instance that has a unique <<kibana-index, `kibana.index`>> setting. Defaults to `.reporting`.
|
||||
|
||||
| `xpack.reporting.roles.allow`
|
||||
| Specifies the roles in addition to superusers that can use reporting.
|
||||
|
|
|
|||
|
|
@ -190,26 +190,26 @@ You can configure the following settings in the `kibana.yml` file.
|
|||
| `xpack.security.cookieName`
|
||||
| Sets the name of the cookie used for the session. The default value is `"sid"`.
|
||||
|
||||
| `xpack.security.encryptionKey`
|
||||
|[[xpack-security-encryptionKey]] `xpack.security.encryptionKey`
|
||||
| An arbitrary string of 32 characters or more that is used to encrypt session information. Do **not** expose this key to users of {kib}. By
|
||||
default, a value is automatically generated in memory. If you use that default
|
||||
behavior, all sessions are invalidated when {kib} restarts.
|
||||
In addition, high-availability deployments of {kib} will behave unexpectedly
|
||||
if this setting isn't the same for all instances of {kib}.
|
||||
|
||||
| `xpack.security.secureCookies`
|
||||
|[[xpack-security-secureCookies]] `xpack.security.secureCookies`
|
||||
| Sets the `secure` flag of the session cookie. The default value is `false`. It
|
||||
is automatically set to `true` if `server.ssl.enabled` is set to `true`. Set
|
||||
is automatically set to `true` if <<server-ssl-enabled, `server.ssl.enabled`>> is set to `true`. Set
|
||||
this to `true` if SSL is configured outside of {kib} (for example, you are
|
||||
routing requests through a load balancer or proxy).
|
||||
|
||||
| `xpack.security.sameSiteCookies` {ess-icon}
|
||||
| Sets the `SameSite` attribute of the session cookie. This allows you to declare whether your cookie should be restricted to a first-party or same-site context.
|
||||
Valid values are `Strict`, `Lax`, `None`.
|
||||
This is *not set* by default, which modern browsers will treat as `Lax`. If you use Kibana embedded in an iframe in modern browsers, you might need to set it to `None`. Setting this value to `None` requires cookies to be sent over a secure connection by setting `xpack.security.secureCookies: true`.
|
||||
This is *not set* by default, which modern browsers will treat as `Lax`. If you use Kibana embedded in an iframe in modern browsers, you might need to set it to `None`. Setting this value to `None` requires cookies to be sent over a secure connection by setting <<xpack-security-secureCookies, `xpack.security.secureCookies`>>: `true`.
|
||||
|
||||
| `xpack.security.session.idleTimeout` {ess-icon}
|
||||
| Ensures that user sessions will expire after a period of inactivity. This and `xpack.security.session.lifespan` are both
|
||||
|[[xpack-session-idleTimeout]] `xpack.security.session.idleTimeout` {ess-icon}
|
||||
| Ensures that user sessions will expire after a period of inactivity. This and <<xpack-session-lifespan,`xpack.security.session.lifespan`>> are both
|
||||
highly recommended. By default, this setting is not set.
|
||||
|
||||
2+a|
|
||||
|
|
@ -218,9 +218,9 @@ highly recommended. By default, this setting is not set.
|
|||
The format is a string of `<count>[ms\|s\|m\|h\|d\|w\|M\|Y]` (e.g. '20m', '24h', '7d', '1w').
|
||||
============
|
||||
|
||||
| `xpack.security.session.lifespan` {ess-icon}
|
||||
|[[xpack-session-lifespan]] `xpack.security.session.lifespan` {ess-icon}
|
||||
| Ensures that user sessions will expire after the defined time period. This behavior also known as an "absolute timeout". If
|
||||
this is _not_ set, user sessions could stay active indefinitely. This and `xpack.security.session.idleTimeout` are both highly
|
||||
this is _not_ set, user sessions could stay active indefinitely. This and <<xpack-session-idleTimeout, `xpack.security.session.idleTimeout`>> are both highly
|
||||
recommended. By default, this setting is not set.
|
||||
|
||||
2+a|
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ See our https://www.elastic.co/legal/privacy-statement[Privacy Statement] to lea
|
|||
|
||||
[cols="2*<"]
|
||||
|===
|
||||
| `telemetry.enabled`
|
||||
|[[telemetry-enabled]] `telemetry.enabled`
|
||||
| Set to `true` to send cluster statistics to Elastic. Reporting your
|
||||
cluster statistics helps us improve your user experience. Your data is never
|
||||
shared with anyone. Set to `false` to disable statistics reporting from any
|
||||
|
|
@ -31,16 +31,16 @@ See our https://www.elastic.co/legal/privacy-statement[Privacy Statement] to lea
|
|||
it is behind a firewall and falls back to `'browser'` to send it from users' browsers
|
||||
when they are navigating through {kib}. Defaults to `'server'`.
|
||||
|
||||
| `telemetry.optIn`
|
||||
|[[telemetry-optIn]] `telemetry.optIn`
|
||||
| Set to `true` to automatically opt into reporting cluster statistics. You can also opt out through
|
||||
*Advanced Settings* in {kib}. Defaults to `true`.
|
||||
|
||||
| `telemetry.allowChangingOptInStatus`
|
||||
| Set to `true` to allow overwriting the `telemetry.optIn` setting via the {kib} UI. Defaults to `true`. +
|
||||
| Set to `true` to allow overwriting the <<telemetry-optIn, `telemetry.optIn`>> setting via the {kib} UI. Defaults to `true`. +
|
||||
|
||||
|===
|
||||
|
||||
[NOTE]
|
||||
============
|
||||
When `false`, `telemetry.optIn` must be `true`. To disable telemetry and not allow users to change that parameter, use `telemetry.enabled`.
|
||||
When `false`, <<telemetry-optIn, `telemetry.optIn`>> must be `true`. To disable telemetry and not allow users to change that parameter, use <<telemetry-enabled, `telemetry.enabled`>>.
|
||||
============
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ bin/kibana-keystore create
|
|||
----------------------------------------------------------------
|
||||
|
||||
The file `kibana.keystore` will be created in the directory defined by the
|
||||
`path.data` configuration setting.
|
||||
<<path-data, `path.data`>> configuration setting.
|
||||
|
||||
[float]
|
||||
[[list-settings]]
|
||||
|
|
|
|||
|
|
@ -20,11 +20,11 @@ which may cause a delay before pages start being served.
|
|||
Set to `false` to disable Console. *Default: `true`*
|
||||
|
||||
| `cpu.cgroup.path.override:`
|
||||
| *deprecated* This setting has been renamed to `ops.cGroupOverrides.cpuPath`
|
||||
| *deprecated* This setting has been renamed to <<ops-cGroupOverrides-cpuPath, `ops.cGroupOverrides.cpuPath`>>
|
||||
and the old name will no longer be supported as of 8.0.
|
||||
|
||||
| `cpuacct.cgroup.path.override:`
|
||||
| *deprecated* This setting has been renamed to `ops.cGroupOverrides.cpuAcctPath`
|
||||
| *deprecated* This setting has been renamed to <<ops-cGroupOverrides-cpuAcctPath, `ops.cGroupOverrides.cpuAcctPath`>>
|
||||
and the old name will no longer be supported as of 8.0.
|
||||
|
||||
| `csp.rules:`
|
||||
|
|
@ -33,7 +33,7 @@ that disables certain unnecessary and potentially insecure capabilities in
|
|||
the browser. It is strongly recommended that you keep the default CSP rules
|
||||
that ship with {kib}.
|
||||
|
||||
| `csp.strict:`
|
||||
|[[csp-strict]] `csp.strict:`
|
||||
| Blocks {kib} access to any browser that
|
||||
does not enforce even rudimentary CSP rules. In practice, this disables
|
||||
support for older, less safe browsers like Internet Explorer.
|
||||
|
|
@ -43,15 +43,15 @@ For more information, refer to <<csp-strict-mode, Content Security Policy>>.
|
|||
| `csp.warnLegacyBrowsers:`
|
||||
| Shows a warning message after loading {kib} to any browser that does not
|
||||
enforce even rudimentary CSP rules, though {kib} is still accessible. This
|
||||
configuration is effectively ignored when `csp.strict` is enabled.
|
||||
configuration is effectively ignored when <<csp-strict, `csp.strict`>> is enabled.
|
||||
*Default: `true`*
|
||||
|
||||
| `elasticsearch.customHeaders:`
|
||||
| Header names and values to send to {es}. Any custom headers cannot be
|
||||
overwritten by client-side headers, regardless of the
|
||||
`elasticsearch.requestHeadersWhitelist` configuration. *Default: `{}`*
|
||||
<<elasticsearch-requestHeadersWhitelist, `elasticsearch.requestHeadersWhitelist`>> configuration. *Default: `{}`*
|
||||
|
||||
| `elasticsearch.hosts:`
|
||||
|[[elasticsearch-hosts]] `elasticsearch.hosts:`
|
||||
| The URLs of the {es} instances to use for all your queries. All nodes
|
||||
listed here must be on the same cluster. *Default: `[ "http://localhost:9200" ]`*
|
||||
+
|
||||
|
|
@ -59,28 +59,28 @@ To enable SSL/TLS for outbound connections to {es}, use the `https` protocol
|
|||
in this setting.
|
||||
|
||||
| `elasticsearch.logQueries:`
|
||||
| Log queries sent to {es}. Requires `logging.verbose` set to `true`.
|
||||
| Log queries sent to {es}. Requires <<logging-verbose, `logging.verbose`>> set to `true`.
|
||||
This is useful for seeing the query DSL generated by applications that
|
||||
currently do not have an inspector, for example Timelion and Monitoring.
|
||||
*Default: `false`*
|
||||
|
||||
| `elasticsearch.pingTimeout:`
|
||||
|[[elasticsearch-pingTimeout]] `elasticsearch.pingTimeout:`
|
||||
| Time in milliseconds to wait for {es} to respond to pings.
|
||||
*Default: the value of the `elasticsearch.requestTimeout` setting*
|
||||
*Default: the value of the <<elasticsearch-requestTimeout, `elasticsearch.requestTimeout`>> setting*
|
||||
|
||||
| `elasticsearch.preserveHost:`
|
||||
| When the value is `true`, {kib} uses the hostname specified in the
|
||||
`server.host` setting. When the value is `false`, {kib} uses
|
||||
<<server-host, `server.host`>> setting. When the value is `false`, {kib} uses
|
||||
the hostname of the host that connects to this {kib} instance. *Default: `true`*
|
||||
|
||||
| `elasticsearch.requestHeadersWhitelist:`
|
||||
|[[elasticsearch-requestHeadersWhitelist]] `elasticsearch.requestHeadersWhitelist:`
|
||||
| List of {kib} client-side headers to send to {es}. To send *no* client-side
|
||||
headers, set this value to [] (an empty list). Removing the `authorization`
|
||||
header from being whitelisted means that you cannot use
|
||||
<<basic-authentication, basic authentication>> in {kib}.
|
||||
*Default: `[ 'authorization' ]`*
|
||||
|
||||
| `elasticsearch.requestTimeout:`
|
||||
|[[elasticsearch-requestTimeout]] `elasticsearch.requestTimeout:`
|
||||
| Time in milliseconds to wait for responses from the back end or {es}.
|
||||
This value must be a positive integer. *Default: `30000`*
|
||||
|
||||
|
|
@ -99,7 +99,7 @@ nodes. *Default: `false`*
|
|||
| Update the list of {es} nodes immediately following a connection fault.
|
||||
*Default: `false`*
|
||||
|
||||
| `elasticsearch.ssl.alwaysPresentCertificate:`
|
||||
|[[elasticsearch-ssl-alwaysPresentCertificate]] `elasticsearch.ssl.alwaysPresentCertificate:`
|
||||
| Controls {kib} behavior in regard to presenting a client certificate when
|
||||
requested by {es}. This setting applies to all outbound SSL/TLS connections
|
||||
to {es}, including requests that are proxied for end users. *Default: `false`*
|
||||
|
|
@ -109,7 +109,7 @@ to {es}, including requests that are proxied for end users. *Default: `false`*
|
|||
[WARNING]
|
||||
============
|
||||
When {es} uses certificates to authenticate end users with a PKI realm
|
||||
and `elasticsearch.ssl.alwaysPresentCertificate` is `true`,
|
||||
and <<elasticsearch-ssl-alwaysPresentCertificate, `elasticsearch.ssl.alwaysPresentCertificate`>> is `true`,
|
||||
proxied requests may be executed as the identity that is tied to the {kib}
|
||||
server.
|
||||
============
|
||||
|
|
@ -117,7 +117,7 @@ server.
|
|||
[cols="2*<"]
|
||||
|===
|
||||
|
||||
| `elasticsearch.ssl.certificate:` and `elasticsearch.ssl.key:`
|
||||
|[[elasticsearch-ssl-cert-key]] `elasticsearch.ssl.certificate:` and `elasticsearch.ssl.key:`
|
||||
| Paths to a PEM-encoded X.509 client certificate and its corresponding
|
||||
private key. These are used by {kib} to authenticate itself when making
|
||||
outbound SSL/TLS connections to {es}. For this setting to take effect, the
|
||||
|
|
@ -129,27 +129,29 @@ be set to `"required"` or `"optional"` to request a client certificate from
|
|||
|
||||
[NOTE]
|
||||
============
|
||||
These settings cannot be used in conjunction with `elasticsearch.ssl.keystore.path`.
|
||||
These settings cannot be used in conjunction with
|
||||
<<elasticsearch-ssl-keystore-path, `elasticsearch.ssl.keystore.path`>>.
|
||||
============
|
||||
|
||||
[cols="2*<"]
|
||||
|===
|
||||
|
||||
| `elasticsearch.ssl.certificateAuthorities:`
|
||||
|[[elasticsearch-ssl-certificateAuthorities]] `elasticsearch.ssl.certificateAuthorities:`
|
||||
| Paths to one or more PEM-encoded X.509 certificate authority (CA)
|
||||
certificates, which make up a trusted certificate chain for {es}. This chain is
|
||||
used by {kib} to establish trust when making outbound SSL/TLS connections to
|
||||
{es}.
|
||||
+
|
||||
In addition to this setting, trusted certificates may be specified via
|
||||
`elasticsearch.ssl.keystore.path` and/or `elasticsearch.ssl.truststore.path`.
|
||||
<<elasticsearch-ssl-keystore-path, `elasticsearch.ssl.keystore.path`>> and/or
|
||||
<<elasticsearch-ssl-truststore-path, `elasticsearch.ssl.truststore.path`>>.
|
||||
|
||||
| `elasticsearch.ssl.keyPassphrase:`
|
||||
| The password that decrypts the private key that is specified
|
||||
via `elasticsearch.ssl.key`. This value is optional, as the key may not be
|
||||
via <<elasticsearch-ssl-cert-key, `elasticsearch.ssl.key`>>. This value is optional, as the key may not be
|
||||
encrypted.
|
||||
|
||||
| `elasticsearch.ssl.keystore.path:`
|
||||
|[[elasticsearch-ssl-keystore-path]] `elasticsearch.ssl.keystore.path:`
|
||||
| Path to a PKCS#12 keystore that contains an X.509 client certificate and it's
|
||||
corresponding private key. These are used by {kib} to authenticate itself when
|
||||
making outbound SSL/TLS connections to {es}. For this setting, you must also set
|
||||
|
|
@ -160,15 +162,15 @@ If the keystore contains any additional certificates, they are used as a
|
|||
trusted certificate chain for {es}. This chain is used by {kib} to establish
|
||||
trust when making outbound SSL/TLS connections to {es}. In addition to this
|
||||
setting, trusted certificates may be specified via
|
||||
`elasticsearch.ssl.certificateAuthorities` and/or
|
||||
`elasticsearch.ssl.truststore.path`.
|
||||
<<elasticsearch-ssl-certificateAuthorities, `elasticsearch.ssl.certificateAuthorities`>> and/or
|
||||
<<elasticsearch-ssl-truststore-path, `elasticsearch.ssl.truststore.path`>>.
|
||||
|
||||
|===
|
||||
|
||||
[NOTE]
|
||||
============
|
||||
This setting cannot be used in conjunction with
|
||||
`elasticsearch.ssl.certificate` or `elasticsearch.ssl.key`.
|
||||
<<elasticsearch-ssl-cert-key, `elasticsearch.ssl.certificate`>> or <<elasticsearch-ssl-cert-key, `elasticsearch.ssl.key`>>.
|
||||
============
|
||||
|
||||
[cols="2*<"]
|
||||
|
|
@ -176,24 +178,24 @@ This setting cannot be used in conjunction with
|
|||
|
||||
| `elasticsearch.ssl.keystore.password:`
|
||||
| The password that decrypts the keystore specified via
|
||||
`elasticsearch.ssl.keystore.path`. If the keystore has no password, leave this
|
||||
<<elasticsearch-ssl-keystore-path, `elasticsearch.ssl.keystore.path`>>. If the keystore has no password, leave this
|
||||
as blank. If the keystore has an empty password, set this to
|
||||
`""`.
|
||||
|
||||
| `elasticsearch.ssl.truststore.path:`::
|
||||
|[[elasticsearch-ssl-truststore-path]] `elasticsearch.ssl.truststore.path:`
|
||||
| Path to a PKCS#12 trust store that contains one or more X.509 certificate
|
||||
authority (CA) certificates, which make up a trusted certificate chain for
|
||||
{es}. This chain is used by {kib} to establish trust when making outbound
|
||||
SSL/TLS connections to {es}.
|
||||
+
|
||||
In addition to this setting, trusted certificates may be specified via
|
||||
`elasticsearch.ssl.certificateAuthorities` and/or
|
||||
`elasticsearch.ssl.keystore.path`.
|
||||
<<elasticsearch-ssl-certificateAuthorities, `elasticsearch.ssl.certificateAuthorities`>> and/or
|
||||
<<elasticsearch-ssl-keystore-path, `elasticsearch.ssl.keystore.path`>>.
|
||||
|
||||
|`elasticsearch.ssl.truststore.password:`
|
||||
| The password that decrypts the trust store specified via
|
||||
`elasticsearch.ssl.truststore.path`. If the trust store has no password,
|
||||
leave this as blank. If the trust store has an empty password, set this to `""`.
|
||||
<<elasticsearch-ssl-truststore-path, `elasticsearch.ssl.truststore.path`>>. If the trust store
|
||||
has no password, leave this as blank. If the trust store has an empty password, set this to `""`.
|
||||
|
||||
| `elasticsearch.ssl.verificationMode:`
|
||||
| Controls the verification of the server certificate that {kib} receives when
|
||||
|
|
@ -206,7 +208,7 @@ verification entirely. *Default: `"full"`*
|
|||
| Time in milliseconds to wait for {es} at {kib} startup before retrying.
|
||||
*Default: `5000`*
|
||||
|
||||
| `elasticsearch.username:` and `elasticsearch.password:`
|
||||
|[[elasticsearch-user-passwd]] `elasticsearch.username:` and `elasticsearch.password:`
|
||||
| If your {es} is protected with basic authentication, these settings provide
|
||||
the username and password that the {kib} server uses to perform maintenance
|
||||
on the {kib} index at startup. {kib} users still need to authenticate with
|
||||
|
|
@ -220,7 +222,7 @@ on the {kib} index at startup. {kib} users still need to authenticate with
|
|||
Please use the `defaultRoute` advanced setting instead.
|
||||
The default application to load. *Default: `"home"`*
|
||||
|
||||
| `kibana.index:`
|
||||
|[[kibana-index]] `kibana.index:`
|
||||
| {kib} uses an index in {es} to store saved searches, visualizations, and
|
||||
dashboards. {kib} creates a new index if the index doesn’t already exist.
|
||||
If you configure a custom index, the name must be lowercase, and conform to the
|
||||
|
|
@ -236,7 +238,7 @@ This value must be a whole number greater than zero. *Default: `"1000"`*
|
|||
suggestions. This value must be a whole number greater than zero.
|
||||
*Default: `"100000"`*
|
||||
|
||||
| `logging.dest:`
|
||||
|[[logging-dest]] `logging.dest:`
|
||||
| Enables you to specify a file where {kib} stores log output.
|
||||
*Default: `stdout`*
|
||||
|
||||
|
|
@ -244,7 +246,7 @@ suggestions. This value must be a whole number greater than zero.
|
|||
| Logs output as JSON. When set to `true`, the logs are formatted as JSON
|
||||
strings that include timestamp, log level, context, message text, and any other
|
||||
metadata that may be associated with the log message.
|
||||
When `logging.dest.stdout` is set, and there is no interactive terminal ("TTY"),
|
||||
When <<logging-dest, `logging.dest.stdout`>> is set, and there is no interactive terminal ("TTY"),
|
||||
this setting defaults to `true`. *Default: `false`*
|
||||
|
||||
| `logging.quiet:`
|
||||
|
|
@ -271,7 +273,7 @@ The following example shows a valid logging rotate configuration:
|
|||
|
||||
| `logging.rotate.enabled:`
|
||||
| experimental[] Set the value of this setting to `true` to
|
||||
enable log rotation. If you do not have a `logging.dest` set that is different from `stdout`
|
||||
enable log rotation. If you do not have a <<logging-dest, `logging.dest`>> set that is different from `stdout`
|
||||
that feature would not take any effect. *Default: `false`*
|
||||
|
||||
| `logging.rotate.everyBytes:`
|
||||
|
|
@ -286,9 +288,9 @@ option has to be in the range of 2 to 1024 files. *Default: `7`*
|
|||
|
||||
| `logging.rotate.pollingInterval:`
|
||||
| experimental[] The number of milliseconds for the polling strategy in case
|
||||
the `logging.rotate.usePolling` is enabled. `logging.rotate.usePolling` must be in the 5000 to 3600000 millisecond range. *Default: `10000`*
|
||||
the <<logging-rotate-usePolling, `logging.rotate.usePolling`>> is enabled. `logging.rotate.usePolling` must be in the 5000 to 3600000 millisecond range. *Default: `10000`*
|
||||
|
||||
| `logging.rotate.usePolling:`
|
||||
|[[logging-rotate-usePolling]] `logging.rotate.usePolling:`
|
||||
| experimental[] By default we try to understand the best way to monitoring
|
||||
the log file and warning about it. Please be aware there are some systems where watch api is not accurate. In those cases, in order to get the feature working,
|
||||
the `polling` method could be used enabling that option. *Default: `false`*
|
||||
|
|
@ -308,8 +310,8 @@ requests. *Default: `false`*
|
|||
|
||||
| `map.includeElasticMapsService:` {ess-icon}
|
||||
| Set to `false` to disable connections to Elastic Maps Service.
|
||||
When `includeElasticMapsService` is turned off, only the vector layers configured by `map.regionmap`
|
||||
and the tile layer configured by `map.tilemap.url` are available in <<maps, Maps>>. *Default: `true`*
|
||||
When `includeElasticMapsService` is turned off, only the vector layers configured by <<regionmap-settings, `map.regionmap`>>
|
||||
and the tile layer configured by <<tilemap-url, `map.tilemap.url`>> are available in <<maps, Maps>>. *Default: `true`*
|
||||
|
||||
| `map.proxyElasticMapsServiceInMaps:`
|
||||
| Set to `true` to proxy all <<maps, Maps application>> Elastic Maps Service
|
||||
|
|
@ -427,7 +429,7 @@ override this parameter to use their own Tile Map Service. For example:
|
|||
system for the {kib} UI notification center. Set to `false` to disable the
|
||||
newsfeed system. *Default: `true`*
|
||||
|
||||
| `path.data:`
|
||||
|[[path-data]] `path.data:`
|
||||
| The path where {kib} stores persistent data
|
||||
not saved in {es}. *Default: `data`*
|
||||
|
||||
|
|
@ -438,17 +440,17 @@ not saved in {es}. *Default: `data`*
|
|||
| Set the interval in milliseconds to sample
|
||||
system and process performance metrics. The minimum value is 100. *Default: `5000`*
|
||||
|
||||
| `ops.cGroupOverrides.cpuPath:`
|
||||
|[[ops-cGroupOverrides-cpuPath]] `ops.cGroupOverrides.cpuPath:`
|
||||
| Override for cgroup cpu path when mounted in a
|
||||
manner that is inconsistent with `/proc/self/cgroup`.
|
||||
|
||||
| `ops.cGroupOverrides.cpuAcctPath:`
|
||||
|[[ops-cGroupOverrides-cpuAcctPath]] `ops.cGroupOverrides.cpuAcctPath:`
|
||||
| Override for cgroup cpuacct path when mounted
|
||||
in a manner that is inconsistent with `/proc/self/cgroup`.
|
||||
|
||||
| `server.basePath:`
|
||||
|[[server-basePath]] `server.basePath:`
|
||||
| Enables you to specify a path to mount {kib} at if you are
|
||||
running behind a proxy. Use the `server.rewriteBasePath` setting to tell {kib}
|
||||
running behind a proxy. Use the <<server-rewriteBasePath, `server.rewriteBasePath`>> setting to tell {kib}
|
||||
if it should remove the basePath from requests it receives, and to prevent a
|
||||
deprecation warning at startup. This setting cannot end in a slash (`/`).
|
||||
|
||||
|
|
@ -458,19 +460,19 @@ deprecation warning at startup. This setting cannot end in a slash (`/`).
|
|||
| `server.compression.referrerWhitelist:`
|
||||
| Specifies an array of trusted hostnames, such as the {kib} host, or a reverse
|
||||
proxy sitting in front of it. This determines whether HTTP compression may be used for responses, based on the request `Referer` header.
|
||||
This setting may not be used when `server.compression.enabled` is set to `false`. *Default: `none`*
|
||||
This setting may not be used when <<server-compression, `server.compression.enabled`>> is set to `false`. *Default: `none`*
|
||||
|
||||
| `server.customResponseHeaders:` {ess-icon}
|
||||
| Header names and values to
|
||||
send on all responses to the client from the {kib} server. *Default: `{}`*
|
||||
|
||||
| `server.host:`
|
||||
|[[server-host]] `server.host:`
|
||||
| This setting specifies the host of the
|
||||
back end server. To allow remote users to connect, set the value to the IP address or DNS name of the {kib} server. *Default: `"localhost"`*
|
||||
|
||||
| `server.keepaliveTimeout:`
|
||||
| The number of milliseconds to wait for additional data before restarting
|
||||
the `server.socketTimeout` counter. *Default: `"120000"`*
|
||||
the <<server-socketTimeout, `server.socketTimeout`>> counter. *Default: `"120000"`*
|
||||
|
||||
| `server.maxPayloadBytes:`
|
||||
| The maximum payload size in bytes
|
||||
|
|
@ -480,28 +482,28 @@ for incoming server requests. *Default: `1048576`*
|
|||
| A human-readable display name that
|
||||
identifies this {kib} instance. *Default: `"your-hostname"`*
|
||||
|
||||
| `server.port:`
|
||||
|[[server-port]] `server.port:`
|
||||
| {kib} is served by a back end server. This
|
||||
setting specifies the port to use. *Default: `5601`*
|
||||
|
||||
| `server.requestId.allowFromAnyIp:`
|
||||
|[[server-requestId-allowFromAnyIp]] `server.requestId.allowFromAnyIp:`
|
||||
| Sets whether or not the X-Opaque-Id header should be trusted from any IP address for identifying requests in logs and forwarded to Elasticsearch.
|
||||
|
||||
| `server.requestId.ipAllowlist:`
|
||||
| A list of IPv4 and IPv6 address which the `X-Opaque-Id` header should be trusted from. Normally this would be set to the IP addresses of the load balancers or reverse-proxy that end users use to access Kibana. If any are set, `server.requestId.allowFromAnyIp` must also be set to `false.`
|
||||
| A list of IPv4 and IPv6 address which the `X-Opaque-Id` header should be trusted from. Normally this would be set to the IP addresses of the load balancers or reverse-proxy that end users use to access Kibana. If any are set, <<server-requestId-allowFromAnyIp, `server.requestId.allowFromAnyIp`>> must also be set to `false.`
|
||||
|
||||
| `server.rewriteBasePath:`
|
||||
|[[server-rewriteBasePath]] `server.rewriteBasePath:`
|
||||
| Specifies whether {kib} should
|
||||
rewrite requests that are prefixed with `server.basePath` or require that they
|
||||
rewrite requests that are prefixed with <<server-basePath, `server.basePath`>> or require that they
|
||||
are rewritten by your reverse proxy. In {kib} 6.3 and earlier, the default is
|
||||
`false`. In {kib} 7.x, the setting is deprecated. In {kib} 8.0 and later, the
|
||||
default is `true`. *Default: `deprecated`*
|
||||
|
||||
| `server.socketTimeout:`
|
||||
|[[server-socketTimeout]] `server.socketTimeout:`
|
||||
| The number of milliseconds to wait before closing an
|
||||
inactive socket. *Default: `"120000"`*
|
||||
|
||||
| `server.ssl.certificate:` and `server.ssl.key:`
|
||||
|[[server-ssl-cert-key]] `server.ssl.certificate:` and `server.ssl.key:`
|
||||
| Paths to a PEM-encoded X.509 server certificate and its corresponding private key. These
|
||||
are used by {kib} to establish trust when receiving inbound SSL/TLS connections from users.
|
||||
|
||||
|
|
@ -509,18 +511,18 @@ are used by {kib} to establish trust when receiving inbound SSL/TLS connections
|
|||
|
||||
[NOTE]
|
||||
============
|
||||
These settings cannot be used in conjunction with `server.ssl.keystore.path`.
|
||||
These settings cannot be used in conjunction with <<server-ssl-keystore-path, `server.ssl.keystore.path`>>.
|
||||
============
|
||||
|
||||
[cols="2*<"]
|
||||
|===
|
||||
|
||||
| `server.ssl.certificateAuthorities:`
|
||||
|[[server-ssl-certificateAuthorities]] `server.ssl.certificateAuthorities:`
|
||||
| Paths to one or more PEM-encoded X.509 certificate authority (CA) certificates which make up a
|
||||
trusted certificate chain for {kib}. This chain is used by {kib} to establish trust when receiving inbound SSL/TLS connections from end
|
||||
users. If PKI authentication is enabled, this chain is also used by {kib} to verify client certificates from end users.
|
||||
+
|
||||
In addition to this setting, trusted certificates may be specified via `server.ssl.keystore.path` and/or `server.ssl.truststore.path`.
|
||||
In addition to this setting, trusted certificates may be specified via <<server-ssl-keystore-path, `server.ssl.keystore.path`>> and/or <<server-ssl-truststore-path, `server.ssl.truststore.path`>>.
|
||||
|
||||
| `server.ssl.cipherSuites:`
|
||||
| Details on the format, and the valid options, are available via the
|
||||
|
|
@ -533,53 +535,53 @@ connections. Valid values are `"required"`, `"optional"`, and `"none"`. Using `"
|
|||
client presents a certificate, using `"optional"` will allow a client to present a certificate if it has one, and using `"none"` will
|
||||
prevent a client from presenting a certificate. *Default: `"none"`*
|
||||
|
||||
| `server.ssl.enabled:`
|
||||
|[[server-ssl-enabled]] `server.ssl.enabled:`
|
||||
| Enables SSL/TLS for inbound connections to {kib}. When set to `true`, a certificate and its
|
||||
corresponding private key must be provided. These can be specified via `server.ssl.keystore.path` or the combination of
|
||||
`server.ssl.certificate` and `server.ssl.key`. *Default: `false`*
|
||||
corresponding private key must be provided. These can be specified via <<server-ssl-keystore-path, `server.ssl.keystore.path`>> or the combination of
|
||||
<<server-ssl-cert-key, `server.ssl.certificate`>> and <<server-ssl-cert-key, `server.ssl.key`>>. *Default: `false`*
|
||||
|
||||
| `server.ssl.keyPassphrase:`
|
||||
| The password that decrypts the private key that is specified via `server.ssl.key`. This value
|
||||
| The password that decrypts the private key that is specified via <<server-ssl-cert-key, `server.ssl.key`>>. This value
|
||||
is optional, as the key may not be encrypted.
|
||||
|
||||
| `server.ssl.keystore.path:`
|
||||
|[[server-ssl-keystore-path]] `server.ssl.keystore.path:`
|
||||
| Path to a PKCS#12 keystore that contains an X.509 server certificate and its corresponding private key. If the
|
||||
keystore contains any additional certificates, those will be used as a trusted certificate chain for {kib}. All of these are used by {kib}
|
||||
to establish trust when receiving inbound SSL/TLS connections from end users. The certificate chain is also used by {kib} to verify client
|
||||
certificates from end users when PKI authentication is enabled.
|
||||
+
|
||||
In addition to this setting, trusted certificates may be specified via `server.ssl.certificateAuthorities` and/or
|
||||
`server.ssl.truststore.path`.
|
||||
In addition to this setting, trusted certificates may be specified via <<server-ssl-certificateAuthorities, `server.ssl.certificateAuthorities`>> and/or
|
||||
<<server-ssl-truststore-path, `server.ssl.truststore.path`>>.
|
||||
|
||||
|===
|
||||
|
||||
[NOTE]
|
||||
============
|
||||
This setting cannot be used in conjunction with `server.ssl.certificate` or `server.ssl.key`
|
||||
This setting cannot be used in conjunction with <<server-ssl-cert-key, `server.ssl.certificate`>> or <<server-ssl-cert-key, `server.ssl.key`>>
|
||||
============
|
||||
|
||||
[cols="2*<"]
|
||||
|===
|
||||
|
||||
| `server.ssl.keystore.password:`
|
||||
| The password that will be used to decrypt the keystore specified via `server.ssl.keystore.path`. If the
|
||||
| The password that will be used to decrypt the keystore specified via <<server-ssl-keystore-path, `server.ssl.keystore.path`>>. If the
|
||||
keystore has no password, leave this unset. If the keystore has an empty password, set this to `""`.
|
||||
|
||||
| `server.ssl.truststore.path:`
|
||||
|[[server-ssl-truststore-path]] `server.ssl.truststore.path:`
|
||||
| Path to a PKCS#12 trust store that contains one or more X.509 certificate authority (CA) certificates which
|
||||
make up a trusted certificate chain for {kib}. This chain is used by {kib} to establish trust when receiving inbound SSL/TLS connections
|
||||
from end users. If PKI authentication is enabled, this chain is also used by {kib} to verify client certificates from end users.
|
||||
+
|
||||
In addition to this setting, trusted certificates may be specified via `server.ssl.certificateAuthorities` and/or
|
||||
`server.ssl.keystore.path`.
|
||||
In addition to this setting, trusted certificates may be specified via <<server-ssl-certificateAuthorities, `server.ssl.certificateAuthorities`>> and/or
|
||||
<<server-ssl-keystore-path, `server.ssl.keystore.path`>>.
|
||||
|
||||
| `server.ssl.truststore.password:`
|
||||
| The password that will be used to decrypt the trust store specified via `server.ssl.truststore.path`. If
|
||||
| The password that will be used to decrypt the trust store specified via <<server-ssl-truststore-path, `server.ssl.truststore.path`>>. If
|
||||
the trust store has no password, leave this unset. If the trust store has an empty password, set this to `""`.
|
||||
|
||||
| `server.ssl.redirectHttpFromPort:`
|
||||
| {kib} binds to this port and redirects
|
||||
all http requests to https over the port configured as `server.port`.
|
||||
all http requests to https over the port configured as <<server-port, `server.port`>>.
|
||||
|
||||
| `server.ssl.supportedProtocols:`
|
||||
| An array of supported protocols with versions.
|
||||
|
|
@ -588,7 +590,7 @@ Valid protocols: `TLSv1`, `TLSv1.1`, `TLSv1.2`. *Default: TLSv1.1, TLSv1.2*
|
|||
| [[settings-xsrf-whitelist]] `server.xsrf.whitelist:`
|
||||
| It is not recommended to disable protections for
|
||||
arbitrary API endpoints. Instead, supply the `kbn-xsrf` header.
|
||||
The `server.xsrf.whitelist` setting requires the following format:
|
||||
The <<settings-xsrf-whitelist, `server.xsrf.whitelist`>> setting requires the following format:
|
||||
|
||||
|===
|
||||
|
||||
|
|
@ -608,18 +610,18 @@ The `server.xsrf.whitelist` setting requires the following format:
|
|||
setting this to `true` enables unauthenticated users to access the {kib}
|
||||
server status API and status page. *Default: `false`*
|
||||
|
||||
| `telemetry.allowChangingOptInStatus`
|
||||
|[[telemetry-allowChangingOptInStatus]] `telemetry.allowChangingOptInStatus`
|
||||
| When `true`, users are able to change the telemetry setting at a later time in
|
||||
<<advanced-options, Advanced Settings>>. When `false`,
|
||||
{kib} looks at the value of `telemetry.optIn` to determine whether to send
|
||||
telemetry data or not. `telemetry.allowChangingOptInStatus` and `telemetry.optIn`
|
||||
{kib} looks at the value of <<settings-telemetry-optIn, `telemetry.optIn`>> to determine whether to send
|
||||
telemetry data or not. <<telemetry-allowChangingOptInStatus, `telemetry.allowChangingOptInStatus`>> and <<settings-telemetry-optIn, `telemetry.optIn`>>
|
||||
cannot be `false` at the same time. *Default: `true`*.
|
||||
|
||||
| `telemetry.optIn`
|
||||
|[[settings-telemetry-optIn]] `telemetry.optIn`
|
||||
| When `true`, telemetry data is sent to Elastic.
|
||||
When `false`, collection of telemetry data is disabled.
|
||||
To enable telemetry and prevent users from disabling it,
|
||||
set `telemetry.allowChangingOptInStatus` to `false` and `telemetry.optIn` to `true`.
|
||||
set <<telemetry-allowChangingOptInStatus, `telemetry.allowChangingOptInStatus`>> to `false` and <<settings-telemetry-optIn, `telemetry.optIn`>> to `true`.
|
||||
*Default: `true`*
|
||||
|
||||
| `telemetry.enabled`
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue