Why does Beat need to connect to Kibana?

In filebeat.yml there is this line

Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.

But filebeat either connects to logstash or directly to elastic search. Elastic search then in return will connect to Kibana. Why does Filebeat need to connect to Kibana?


If you want visualize Filebeat data in Kibana, you need to create Visualization, DashBoards and Searches. Filebeat comes packaged with example Kibana dashboards, visualizations, and searches to help you visualize data in Kibana.

Thanks for clarification.

But how comes the config doesn't have a username/password in the Kibana section? Because the filebeats will be on separate servers and have to connect remotely to the central Kibana.

# =================================== Kibana ===================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  # host: "localhost:5601"

  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.

Kibana's authentication uses whatever is setup in Elasticsearch. So if you have defined username+password for Elasticsearch, then it can reuse that.

ALL beats don't, just one of each type, of each version you intend to use and before any others attempt to send logs. The beats setup required auth I don't intend to give to "just logging" clients.