Kibana Api

Kibana API Utilities

This skill provides shared shell utilities for other skills that need to call Kibana APIs.

Usage

Source scripts/kibana_api_common.sh from any skill script:

REPO_ROOT="$(git rev-parse --show-toplevel)"
source "$REPO_ROOT/scripts/kibana_api_common.sh"

After sourcing, the following are available:

• `KIBANA_URL` — Detected base URL (e.g., http://localhost:5601)
• `KIBANA_AUTH` — Detected credentials (e.g., elastic:changeme)
• `kibana_curl [curl args...]` — curl wrapper with auth, kbn-xsrf, x-elastic-internal-origin, and TLS flags pre-configured

Auto-Detection

Tries these permutations automatically:

• URLs: http://localhost:5601, https://localhost:5601
• Auth: elastic:changeme, elastic_serverless:changeme

Override with environment variables KIBANA_URL and/or KIBANA_AUTH before sourcing.

Session Auth (Acting as a Browser User)

By default, kibana_curl authenticates via HTTP Basic auth, which uses the __http__ auth provider. This is a different auth realm than the browser, which uses the basic provider. Any per-user state tied to a browser session (e.g. OAuth tokens, user-specific settings) will not be visible to API calls made with HTTP Basic auth.

To authenticate in the same auth realm as a browser user, set KIBANA_USE_SESSION=true before sourcing:

export KIBANA_USE_SESSION=true
REPO_ROOT="$(git rev-parse --show-toplevel)"
source "$REPO_ROOT/scripts/kibana_api_common.sh"

This logs in via the basic auth provider and uses a session cookie for all subsequent kibana_curl calls. The default behavior is unchanged when the variable is unset or false.