Kibana

Analyze the impact of deleting or modifying a saved object (what will be affected)

Analyze dependency tree for a Kibana saved object (Dashboard, Visualization, etc.)

Perform health check on a Dashboard to detect broken references, performance issues, etc.

Execute a custom API request for Kibana with multi-space support. For Elasticsearch document or log searches, use search_elasticsearch instead. Do not use /api/console/proxy for Elasticsearch searches: that Console endpoint can require Dev Tools privileges even when the configured user can read the target indices. Do not use this generic tool to rediscover an Elasticsearch search route when search_elasticsearch already provides the supported workflow. RETRY SAFETY: this tool can reach any write endpoint. A POST retried after a timeout or dropped response can create a duplicate — prefer a caller-chosen stable id (or the vl_* tool for that object type, which documents the safe pattern) over letting the server auto-generate one.

Get all available Kibana spaces with current context

Get details for a specific Kibana API endpoint

Get Kibana server status with multi-space support

List all Kibana API endpoints as a resource list

Scan health status of all Dashboards in a space (returns summary report)

Search Elasticsearch documents, logs, and aggregations through Kibana using Elasticsearch Query DSL. USE THIS TOOL whenever the task is to find or inspect Elasticsearch data. Do not first search Kibana API paths and do not call /api/console/proxy through execute_kb_api for Elasticsearch searches. The Console proxy can require the Kibana Dev Tools privilege even when the configured user is allowed to read the target indices. This tool uses the user's existing Elasticsearch permissions. SEARCH STRATEGY FOR LOGS: 1. Start with the narrowest known index pattern and a small time window. 2. Set size explicitly (usually 10-50; maximum 100). 3. Request only useful _source fields when exploring high-volume logs. 4. Sort by the timestamp field if chronology matters. 5. After finding a trace/correlation id, narrow follow-up searches to that id and a small surrounding time window. 6. Prefer exact term/keyword filters when the field mapping supports them; use match/query_string only when text analysis is intended. The body is Elasticsearch Query DSL, not Kibana KQL. If the user describes a filter in KQL terms, translate the intent to Query DSL before calling the tool. A wildcard-only index segment ('*', '**', '_all'), an empty body, and body.size > 100 are rejected. Avoid broad match_all searches. Aggregations are supported through the same body. The returned hits preserve the original _source, including dynamic/custom properties. This uses Kibana's internal /internal/search/es endpoint, so its contract can change between Kibana versions.

Search documented Kibana OpenAPI endpoints by keyword. This index does not necessarily contain Kibana internal routes. Do not use this tool to discover how to search Elasticsearch documents or logs; use search_elasticsearch for that.

Bulk delete multiple Kibana saved objects by type and ID. This is a destructive operation that permanently removes saved objects (dashboard, visualization, index-pattern, search, config, lens, map, tag, canvas-workpad, canvas-element, etc.). WARNING: Deleted objects cannot be recovered. Use with caution. IMPORTANT: Objects that exist in multiple namespaces require the 'force' parameter to be deleted.

Update multiple Kibana saved objects in a single operation. Each object can be of different types and will be partially updated (only specified attributes changed). Supports all saved object types (dashboard, visualization, index-pattern, search, config, lens, map, tag, canvas-workpad, canvas-element, etc.). PERFORMANCE: More efficient than multiple single updates. Each object can have individual version control.

Create a new Kibana saved object (dashboard, visualization, index-pattern, search, config, lens, map, tag, canvas-workpad, canvas-element, etc.). This is a universal tool that can create any type of saved object by specifying the type and attributes. Each object type has specific attribute requirements. IMPORTANT: The 'title' field is required for most object types. Complex fields like panelsJSON, visState should be JSON strings.

Get a single Kibana saved object by type and ID. This is a universal tool that can retrieve any type of saved object (dashboard, visualization, index-pattern, search, config, lens, map, tag, canvas-workpad, canvas-element, etc.) by its exact type and ID. Use this when you know the specific object you want to retrieve. PERFORMANCE: This is much faster than searching when you have the exact type and ID.

Search for Kibana saved objects using Elasticsearch query syntax. This is a universal tool that can search across all saved object types (dashboard, visualization, index-pattern, search, config, lens, map, tag, canvas-workpad, canvas-element, etc.). IMPORTANT: You must specify the 'types' parameter - it is required by the Kibana API. PERFORMANCE TIPS: Always use 'fields' parameter to specify only needed fields (e.g., ['title', 'description']) for faster responses. Use 'perPage' 5-20 for optimal speed. PAGINATION: To get all results, make multiple requests with incrementing 'page' numbers (page=1, page=2, etc.) until you receive fewer results than 'perPage'. Don't stop at the first page - iterate through all pages for complete data. Returns formatted saved object information including type, title, description, and timestamps.

Update a single Kibana saved object by type and ID. This performs a partial update - only the specified attributes will be changed, other attributes remain unchanged. Supports all saved object types (dashboard, visualization, index-pattern, search, config, lens, map, tag, canvas-workpad, canvas-element, etc.). IMPORTANT: Use version parameter for optimistic concurrency control to prevent conflicts.