Type to search.

Load Kibana dashboards

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Packetbeat comes packaged with example Kibana dashboards, visualizations, and searches for visualizing Packetbeat data in Kibana. Before you can use the dashboards, you need to create the index pattern, packetbeat-*, and load the dashboards into Kibana.

To do this, you can either run the setup command (as described here) or configure dashboard loading in the packetbeat.yml config file. This requires a Kibana endpoint configuration. If you didn’t already configure a Kibana endpoint, see Kibana endpoint.

Make sure Kibana is running before you perform this step. If you are accessing a secured Kibana instance, make sure you’ve configured credentials as described in the Quick start: installation and configuration.

To load the recommended index template for writing to Elasticsearch and deploy the sample dashboards for visualizing the data in Kibana, use the command that works with your system.

Note

Use sudo to run these commands if the config file is owned by root.

Shell 
packetbeat setup --dashboards
Shell 
packetbeat setup --dashboards
Shell 
./packetbeat setup --dashboards
Shell 
./packetbeat setup --dashboards
Shell 
docker run --rm --net="host" docker.elastic.co/beats/packetbeat:9.5.6 setup --dashboards

Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).

From the PowerShell prompt, change to the directory where you installed Packetbeat, and run:

Shell 
PS > .\packetbeat.exe setup --dashboards

For more options, such as loading customized dashboards, see Importing Existing Beat Dashboards. If you’ve configured the Logstash output, see Load dashboards for Logstash output.

During dashboard loading, Packetbeat connects to Elasticsearch to check version information. To load dashboards when the Logstash output is enabled, you need to temporarily disable the Logstash output and enable Elasticsearch. To connect to a secured Elasticsearch cluster, you also need to pass Elasticsearch credentials.

Tip

The example shows a hard-coded password, but you should store sensitive values in the secrets keystore.

Shell 
packetbeat setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=packetbeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601
Shell 
packetbeat setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=packetbeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601
Shell 
./packetbeat setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=packetbeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601
Shell 
./packetbeat setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=packetbeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601
Shell 
docker run --rm --net="host" docker.elastic.co/beats/packetbeat:9.5.6 setup -e \
  -E output.logstash.enabled=false \
  -E output.elasticsearch.hosts=['localhost:9200'] \
  -E output.elasticsearch.username=packetbeat_internal \
  -E output.elasticsearch.password=YOUR_PASSWORD \
  -E setup.kibana.host=localhost:5601

Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).

From the PowerShell prompt, change to the directory where you installed Packetbeat, and run:

Shell 
PS > .\packetbeat.exe setup -e `
  -E output.logstash.enabled=false `
  -E output.elasticsearch.hosts=['localhost:9200'] `
  -E output.elasticsearch.username=packetbeat_internal `
  -E output.elasticsearch.password=YOUR_PASSWORD `
  -E setup.kibana.host=localhost:5601