{
  "markdown": "# kibana-mcp\n\n<!-- mcp-name: io.github.mshegolev/kibana-mcp -->\n\n[![PyPI version](https://badge.fury.io/py/kibana-mcp.svg)](https://pypi.org/project/kibana-mcp/)\n[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/)\n[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)\n[![Tests](https://github.com/mshegolev/kibana-mcp/actions/workflows/test.yml/badge.svg)](https://github.com/mshegolev/kibana-mcp/actions)\n\nMCP server for **Kibana / Elasticsearch** — log search, aggregations, index discovery, and dashboard browsing via Claude and any MCP-compatible agent.\n\n## Why another Kibana MCP?\n\nExisting integrations require a running Kibana instance with browser-level credentials and often wrap the Kibana UI rather than the stable REST APIs. This server:\n\n- Hits **Elasticsearch REST API directly** for log queries (faster, stable across Kibana UI changes)\n- Falls back to the **Kibana Console proxy** when no direct ES URL is configured (zero extra firewall rules)\n- Supports **ApiKey auth** (best for agents) as well as Basic auth and anonymous access\n- Returns both **structured JSON** (`outputSchema`) and **markdown text** so it works with any MCP client\n- Is **read-only** — all tools carry `readOnlyHint: true`, no data is modified\n\n## Tools\n\n| Tool | API | Description |\n|------|-----|-------------|\n| `kibana_list_indices` | `GET ES/_cat/indices` | Discover available indices with health, docs, size |\n| `kibana_search_logs` | `POST ES/{index}/_search` | Full-text log search with time range, sort, size |\n| `kibana_aggregate_logs` | `POST ES/{index}/_search` | Terms grouping with count/avg/sum/min/max metric |\n| `kibana_list_dashboards` | `GET Kibana/api/saved_objects/_find` | List saved dashboards with search + pagination |\n| `kibana_get_dashboard` | `GET Kibana/api/saved_objects/dashboard/{id}` | Fetch one dashboard with panel breakdown |\n\n## Installation\n\n```bash\npip install kibana-mcp\n```\n\nOr run directly with `uvx`:\n\n```bash\nuvx kibana-mcp\n```\n\n## Configuration\n\n### Environment Variables\n\n| Variable | Required | Description |\n|----------|----------|-------------|\n| `KIBANA_URL` | Yes | Kibana base URL (e.g. `https://kibana.example.com`) |\n| `ELASTICSEARCH_URL` | No | Direct ES endpoint. If unset, ES requests go through Kibana Console proxy |\n| `KIBANA_API_KEY` | No | ES API key (`ApiKey base64(id:api_key)` format). Recommended for agents |\n| `KIBANA_USERNAME` | No | HTTP Basic auth username (used if API key not set) |\n| `KIBANA_PASSWORD` | No | HTTP Basic auth password |\n| `KIBANA_SSL_VERIFY` | No | `true` (default) or `false` for self-signed certificates |\n\nAuth priority: **ApiKey** > **Basic** > **anonymous**.\n\nCopy `.env.example` to `.env` and fill in your values.\n\n### MCP Client Configuration (Claude Desktop / claude.app)\n\n```json\n{\n  \"mcpServers\": {\n    \"kibana\": {\n      \"command\": \"uvx\",\n      \"args\": [\"kibana-mcp\"],\n      \"env\": {\n        \"KIBANA_URL\": \"https://kibana.example.com\",\n        \"KIBANA_API_KEY\": \"your-api-key-here\"\n      }\n    }\n  }\n}\n```\n\nOr with direct ES access for better performance:\n\n```json\n{\n  \"mcpServers\": {\n    \"kibana\": {\n      \"command\": \"uvx\",\n      \"args\": [\"kibana-mcp\"],\n      \"env\": {\n        \"KIBANA_URL\": \"https://kibana.example.com\",\n        \"ELASTICSEARCH_URL\": \"https://es.example.com:9200\",\n        \"KIBANA_API_KEY\": \"your-api-key-here\"\n      }\n    }\n  }\n}\n```\n\n### Docker\n\n```bash\ndocker run --rm -i \\\n  -e KIBANA_URL=https://kibana.example.com \\\n  -e KIBANA_API_KEY=your-key \\\n  ghcr.io/mshegolev/kibana-mcp\n```\n\n## Usage Examples\n\n### Log Search\n\n```\nFind the last 50 ERROR logs from the API service in the last hour\n```\n→ `kibana_search_logs(index=\"logs-*\", query=\"level:ERROR AND service:api\", size=50, time_from=\"2026-04-18T09:00:00Z\")`\n\n```\nShow 500 HTTP errors sorted oldest first for incident replay\n```\n→ `kibana_search_logs(index=\"nginx-*\", query=\"status:500\", sort_order=\"asc\", size=100)`\n\n### Aggregations\n\n```\nHow many logs per log level in the last hour?\n```\n→ `kibana_aggregate_logs(index=\"logs-*\", group_by=\"level\", time_from=\"2026-04-18T09:00:00Z\")`\n\n```\nWhat is the average response time per service?\n```\n→ `kibana_aggregate_logs(index=\"logs-*\", group_by=\"service.keyword\", metric=\"avg\", metric_field=\"response_time_ms\")`\n\n### Index Discovery\n\n```\nWhat log indices are available?\n```\n→ `kibana_list_indices()`\n\n```\nShow me all filebeat indices\n```\n→ `kibana_list_indices(pattern=\"filebeat-*\")`\n\n### Dashboards\n\n```\nFind the infrastructure dashboard\n```\n→ `kibana_list_dashboards(search=\"infrastructure\")`\n\n```\nWhat panels does dashboard X have?\n```\n→ `kibana_get_dashboard(dashboard_id=\"<id from list_dashboards>\")`\n\n## Performance Characteristics\n\n- **Log search** (`kibana_search_logs`): typically 50-500ms with direct ES URL; add 100-200ms when routing through Kibana Console proxy\n- **Aggregations** (`kibana_aggregate_logs`): `size:0` queries — no hits transferred, usually 10-100ms\n- **Index listing**: single `_cat/indices` call, O(index_count) response, typically <100ms\n- **Dashboard APIs**: Kibana Saved Objects API, typically 50-200ms; latency is Kibana-side, not network\n- Set `ELASTICSEARCH_URL` directly if your agent does frequent log searches — eliminates the proxy overhead\n\n## Development\n\n```bash\ngit clone https://github.com/mshegolev/kibana-mcp\ncd kibana-mcp\npip install -e '.[dev]'\npytest tests/ -v\nruff check src tests\nruff format src tests\n```\n\n## License\n\nMIT — see [LICENSE](LICENSE).\n",
  "bytes": 5479,
  "sha": "3e09195ca1a17aa0dd64d1e7ce662aeb6852541f7342ad1bcddc15a0cb18706c",
  "repo_slug": "mshegolev/kibana-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_mshegolev_kibana_mcp_f9c67d92/readme"
}