I think Kibana's elasticsearch_url option is singular, i.e. it needs to be exactly one URL. As you've noticed this creates a single point of failure. To mitigate that you could e.g. use HAproxy to front of two or more ES instances and point Kibana to the HAproxy hostname/port.