Telemetry settings in Kibana

Usage Collection (also known as Telemetry) is enabled by default. This allows us to learn what our users are most interested in, so we can improve our products and services.

Refer to our Privacy Statement to learn more.

You can control whether this data is sent from the Kibana servers, or if it should be sent from the user's browser, in case a firewall is blocking the connections from the server. Additionally, you can disable this feature either in Stack Management > Kibana > Advanced Settings > Global Settings > Usage collection or the config file with the following settings.

General telemetry settings

telemetry.optIn

Supported on:

Set to false to stop sending any telemetry data to Elastic. Reporting your cluster statistics helps us improve your user experience.

This setting can be changed at any time in Advanced Settings. To prevent users from changing it, set telemetry.allowChangingOptInStatus to false.

Datatype: bool

Default: true

telemetry.allowChangingOptInStatus

Supported on:

Set to false to disallow overwriting the telemetry.optIn setting via the Advanced Settings in Kibana.

Datatype: bool

Default: true

telemetry.sendUsageFrom

Supported on:

Set to 'server' to report the cluster statistics from the Kibana server. If the server fails to connect to our endpoint at https://telemetry.elastic.co/, it assumes it is behind a firewall and falls back to 'browser' to send it from users' browsers when they are navigating through Kibana.

Datatype: enum

Default: server

Options:

  • browser
  • server
xpack.apm.telemetryCollectionEnabled

Supported on:

Collects information about APM data and API performance. Set this to false to specifically disable APM's collector.

Datatype: bool

Default: true

Kibana transmits certain information about Elastic Security when users interact with the Elastic Security app, detailed below. Kibana redacts or obfuscates personal data such as IP addresses, host names, and usernames before transmitting messages to Elastic. Security-specific telemetry events include:

  • Detection rule security alerts: Information about Elastic-authored prebuilt detection rules using the detection engine. Examples of alert data include machine learning job influencers, process names, and cloud audit events.
  • Elastic Endpoint Security alerts: Information about malicious activity detected using Elastic Endpoint detection engines. Examples of alert data include malicious process names, digital signatures, and file names written by the malicious software. Examples of alert metadata include the time of the alert, the Elastic Endpoint version and related detection engine versions.
  • Configuration data for Elastic Endpoint: Information about the configuration of Elastic Endpoint deployments. Examples of configuration data include the Endpoint versions, operating system versions, and performance counters for Endpoint.
  • Exception list entries for Elastic rules: Information about exceptions added for Elastic rules. Examples include trusted applications, detection exceptions, and rule exceptions.
  • Security alert activity records: Information about actions taken on alerts generated in the Elastic Security app, such as acknowledged or closed.

To learn more, refer to our Privacy Statement.