Security for Elasticsearch and Kibana
Search Guard adds enterprise-grade security to Elasticsearch and Kibana: authentication against your identity provider, role-based access control down to individual documents and fields, multi-tenancy, audit logging, and TLS everywhere — as a plugin inside your cluster, with no extra infrastructure.
What Search Guard secures
Authentication & Single Sign-On
Authenticate users against LDAP and Active Directory, SAML and OpenID Connect providers, Kerberos, JSON web tokens, client certificates, or proxies — combinable in authentication chains. Kibana gets full single sign-on.
Role-based access control
Control permissions on cluster, index, and action level with roles mapped from your directory groups or managed internally. Hot config reload applies changes without cluster restarts.
Document- & field-level security
Define query-based filters so each role sees only its documents, include or exclude individual fields per role, and anonymize sensitive values before they leave the cluster.
Kibana multi-tenancy
Give each team its own tenant with separate dashboards, visualizations, and saved objects — on one shared cluster, with access controlled by Search Guard roles.
Audit logging
Record authentication failures, missing privileges, and security-relevant events. The Compliance Edition adds read- and write-access tracking and immutable indices for regulatory audit trails.
TLS everywhere
Encrypt REST and node-to-node traffic with modern cipher suites, and generate production-ready certificates with the free Search Guard TLS Tool.
How it works
Search Guard is a plugin that runs inside every Elasticsearch node — not a proxy in front of it. Every request, whether it arrives on the REST layer or travels between nodes on the transport layer, is authenticated and authorized inside the cluster before it touches your data. A companion plugin secures Kibana with login, session handling, and multi-tenancy. Nothing else to deploy, no single point of failure, no additional moving parts.
Configure it your way — YAML files, the REST API, the sgctl command-line tool, or point-and-click in the Kibana config GUI.
Every request, checked in order
Authentication first: who is making the request. Authorization second: is this action on this index allowed. Then document- and field-level security filter what the response may contain — and the audit log records what happened. Four layers, applied to every single request.
Free to start, enterprise when you need it
TLS, role-based access control, and internal user management ship free in the Community Edition — forever. Enterprise authentication (SAML, OIDC, LDAP), document- and field-level security, multi-tenancy, and audit logging are part of the Enterprise and Compliance Editions, and every feature is unlocked in the free 60-day trial.
Certified
Integrators
