Kibana

Last reviewed Aug 26, 2026 · 764 words

Kibana is not the expensive part. It idles around 1 GB and is happy on a small VM; the Elasticsearch it cannot live without wants 2 to 4 GB of JVM heap before it stops complaining and, at homelab log volumes, tens of GB of disk per month you keep. Decide whether you want to operate Elasticsearch before you decide anything about Kibana, because Kibana is a window onto exactly one database. If the answer is no, the last section names the lighter stack.

The version numbers must match to the minor

Kibana refuses to start against an Elasticsearch on a different major.minor version: 8.15 talks to 8.15, not 8.14. Pin both images to the identical tag, upgrade Elasticsearch first and Kibana second, and never use latest on either. This one rule explains most "Kibana server is not ready yet" messages on forums.

8.x turns security on, and the enrollment step is the price

Since 8.0, Elasticsearch ships with TLS and authentication enabled, and Kibana needs its own service account password to connect. A LAN-only Compose that keeps security on looks like this:

services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.15.0
    environment:
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms2g -Xmx2g
      - ELASTIC_PASSWORD=change-me-now
    volumes:
      - ./esdata:/usr/share/elasticsearch/data
  kibana:
    image: docker.elastic.co/kibana/kibana:8.15.0
    environment:
      - ELASTICSEARCH_HOSTS=https://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=set-after-first-boot
    ports:
      - "5601:5601"

The order of operations: start Elasticsearch alone, run bin/elasticsearch-reset-password -u kibana_system inside the container, paste the result into Kibana's environment, then start Kibana and log in at port 5601 as elastic. Kibana also has to trust the self-signed CA Elasticsearch generated, which means copying it into the Kibana container or pointing ELASTICSEARCH_SSL_CERTIFICATEAUTHORITIES at it. The shortcut people take on private networks is xpack.security.enabled=false on Elasticsearch and plain http:// in Kibana; that is defensible behind Tailscale, and indefensible on anything routable. On the host, set vm.max_map_count=262144 or Elasticsearch will exit before Kibana gets a chance to complain.

Nothing appears until a shipper sends it

Kibana visualises what is indexed; it does not collect. You need Filebeat or Elastic Agent (Elastic's own), or Fluent Bit if you want a 20 MB process instead of a 200 MB one, reading Docker container logs and posting them to Elasticsearch. Then create a data view in Kibana matching the index pattern (logs- or filebeat-) and Discover starts working. The step people skip and regret: set an index lifecycle policy on day one that deletes indices older than 30 days, because Elasticsearch will otherwise fill the disk and lock the cluster read-only at 95% usage.

What the free tier holds back

Kibana's Basic license, which is what you get self-hosting, includes dashboards, Discover, Lens, Maps, alerting rules and the SIEM-style Security app. The machine-learning anomaly detection the catalogue highlights sits behind the paid Platinum tier, as do cross-cluster features and some connectors. The licensing history matters too: Elastic left Apache-2.0 in 2021, and in 2024 added AGPL-3.0 back as an option, which is the license shown here. OpenSearch and OpenSearch Dashboards are the Apache-2.0 fork from the 7.10 line; they look and behave much like Kibana of that era, and their anomaly detection is free.

Grafana and Loki win for most homelabs

Loki indexes labels rather than log content, so its disk use is a fraction of Elasticsearch's, and Grafana is probably already on your box for metrics. For "show me the nginx errors from last night" on 10 containers, Loki does the job in 512 MB total. Kibana earns its 3 to 5 GB when you need full-text search over everything, field-by-field exploration of structured events, or the security detections. Those are real needs; they are just rarer than the install counts suggest.

What I'd do

Start with Grafana plus Loki unless you already know you need Elasticsearch. If you do need it: one node, 2 GB heap on a host with 8 GB, security left on, Fluent Bit shipping, a 30-day lifecycle policy created before the first dashboard, both images pinned to the same tag and upgraded together on a monthly reminder. Give the pair its own VM so the JVM cannot starve anything else, and treat Kibana as the pleasant part of a stack whose real cost is the database underneath.