# Kibana behind ngix... proxying challenge? **URL:** \ **Category:** Kibana\ **Created:** [May 19, 2015, 8:50am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887 "2015-05-19T08:50:16Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [May 19, 2015, 8:50am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/1 "2015-05-19T08:50:16Z")
Hi forum... I'm playing around with elk, and once I start having nice dashboards there appears the question of proxy them in a controllable manner to some people. Most of the doc around treats the nginx/kibana proxy matter as a same-host approach... but I'm truly wondering wether proxying from nginx public web server to an internal kibana stats server would be reachable. This is something hard... I'm not an expert but when I tried the same thing with munin/rrd graphs it took me a lot of time to figure out the correct setup, as it involved the usage of nginx subs\_filter in order to translate relative path replies coming from the server to understandable paths to the proxy/web client... no one at the munin comunity seemed to have done that before... it was hard but it finally worked. Has anyone ever succeeded in proxying a remote, external, kibana dashboard (ie. a remote ELK stack server), form a front nginx server? Thank you very much... best regards! ---
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [May 19, 2015, 4:47pm UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/2 "2015-05-19T16:47:59Z")
I'm getting closer... but still don't work location /kibana/ { subs\_filter\_types text/html text/css text/xml; subs\_filter href=" href="[http://publicwebserver.example.com/kibana/;](http://publicwebserver.example.com/kibana/;) subs\_filter src=" src="[http://publicwebserver.example.com/kibana/;](http://publicwebserver.example.com/kibana/;) proxy\_pass [http://elkserver.example.net/;](http://elkserver.example.net/;) proxy\_read\_timeout 90; } location /elasticsearch/\_aliases$ { proxy\_pass [http://elkserver.example.net/elasticsearch/\_aliases;](http://elkserver.example.net/elasticsearch/_aliases;) proxy\_read\_timeout 90; } location /elasticsearch/.\*/\_aliases$ { proxy\_pass [http://elkserver.example.net/;](http://elkserver.example.net/;) proxy\_read\_timeout 90; } location /elasticsearch/\_nodes$ { proxy\_pass [http://elkserver.example.net/elasticsearch/\_nodes;](http://elkserver.example.net/elasticsearch/_nodes;) proxy\_read\_timeout 90; } location /elasticsearch/.\*/\_search$ { proxy\_pass [http://elkserver.example.net/;](http://elkserver.example.net/;) proxy\_read\_timeout 90; } location /elasticsearch/.\*/\_mapping$ { proxy\_pass [http://elkserver.example.net/;](http://elkserver.example.net/;) proxy\_read\_timeout 90; } At least I can load js, css and lot of stuff... now I'm dealing on how to proxy elasticsearch/\_ndes \_search etc, atc properly to the internal elkserver in order to it perform the actual query to elasticsearch. Will post if further success, maybe someone is interested ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 20, 2015, 7:44am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/3 "2015-05-20T07:44:16Z")
What version are you proxying? ---
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [May 20, 2015, 8:34am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/4 "2015-05-20T08:34:32Z")
I'm proxying version 3 of kibana... My Idea is to setup a small site in front of kibana, in order to control that only a securely loged in user can access exclusively a list of dashboards. The small site is just a light sqlite driven site, with a login screen folled by a simple selector that will load into a div the proxied location (a remote kibana dashboard). The idea is that I can control what the final user will see, and ensure i can prevent it to do strange things sucha as delete dashboards or freely navigate other dashboards or query elasticsearch, or at least make it hard to figure out... This is something I did in the past with munin: by using a proxy, users cannot navigate beyond their graphs proxied site. Also, I like to keep the actual graphing/statistics server away from users... and let them only acces via a proxy request from a regular web server. I have seen some kibana - proxy projects in github doing something similar... but they seem to host kibana locally, so direct access to elasticsearch from the hosting server would be required. And I also like to have a small database and a litle php session environment to allow users to sigle sign on upon login and let them navigate their dashboards... My problem is that since I did it with munin... I would like to have the same with ELK... I will share my success or my shame!!!! 😄 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 20, 2015, 8:36am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/5 "2015-05-20T08:36:36Z")
There is an example config we provided for KB3 - [https://github.com/elastic/kibana/blob/3.0/sample/nginx.conf](https://github.com/elastic/kibana/blob/3.0/sample/nginx.conf) - try to see if you can adopt that to your needs. ---
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [May 20, 2015, 9:22am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/6 "2015-05-20T09:22:20Z")
Got a very basic functional setup... location /kibana/ { subs\_filter\_types text/html text/css text/xml; subs\_filter href=" href="[http://publicwebserver.example.com/kibana/;](http://publicwebserver.example.com/kibana/;) subs\_filter src=" src="[http://publicwebserver.example.com/kibana/;](http://publicwebserver.example.com/kibana/;) proxy\_pass [http://elkserver.example.net/;](http://elkserver.example.net/;) proxy\_read\_timeout 90; } location /elasticsearch/ { proxy\_pass [http://elkserver.example.net](http://elkserver.example.net); proxy\_read\_timeout 90; } This but behaves transparent... here some kind of control should be implemented in top of it ---
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [May 25, 2015, 2:19pm UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/7 "2015-05-25T14:19:22Z")
... saaaad but true... Give up on this: anchor based urls and dynamic way to work makes it (at least at my knoledge level) impossible to proxy in a controllable manner using nginx: proxy all or nothing. So, at the end, ELK falls short on the 'K'... it turned out to be a great tool for system admins, but once you got your dashboards you cannot share them safely: nothing prevents people from accesing other people data, destroying dashboards, etc... Dashboards with disabled edit mode or .htaccess restrictions are just workaround, but nothing I would trust on. I'm getting interested on shield... Also I'm using kibana 3, so maybe kibana 4 helps! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2015, 12:54am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/8 "2015-05-26T00:54:08Z")
You could do a detailed proxy setup with ACLs to solve this. But Shield is what you really want. ---
**Author:** ![alexolivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexolivan/32/57425_2.png) [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Post date:** [May 26, 2015, 9:35am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/9 "2015-05-26T09:35:45Z")
Aha... yes ACLs were my approach but I didnt suceed on handling URLs correctly. Googling around I faced common assertions that nginx proxying process does not handle anchored (#) url parts. I asked on the nginx forum to no avail... I don't dare to say this is not possible at all, but the matter is either too complex to my limited nginx knowledge level... or maybe even not possible at all. Anyhow I've been reading about shield and yes! it effectiveley solves the question! ... but just on the backend part. ... without a propper frontend, I will deploy ELK just for internal/private usage... and for just internal/private usage I do not need shield.... overall I have the feeling the stack falls short just before the end line. Anyhow... for internal usage I have decided to move to ELK all monitoring infraestructure! I'm loving it!!!! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 26, 2015, 10:45am UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/10 "2015-05-26T10:45:00Z")
Good to hear! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 2:19pm UTC](https://discuss.elastic.co/t/kibana-behind-ngix-proxying-challenge/887/11 "2017-07-06T14:19:05Z")