Kibana Log Analysis & API Dashboard MCP Server

An MCP (Model Context Protocol) server designed for enterprise developers to connect local AI assistants directly to Elasticsearch, Kibana, and local codebases.

⚠️ For New Developers & Forkers

If you have just cloned this repository to use within your organization, search the codebase for TODO: comments. There are several places where data or settings should be manually updated to fit your company's architecture.

The most crucial manual updates inside src/index.ts include:

1. Log Schema Customization: Update the .level or http.response.status_code fields to match your company's logging convention.

2. Self-Signed Certificates: Add your internal CA cert path if your Elasticsearch instance does not use public SSL certificates.

3. Regex Parsers for .NET or Go: If your team uses languages other than Java/Typescript, update the scan_code_for_apis tool regex.

Related MCP server: elasticsearch-mcp

Features

• search_logs: Search Elasticsearch indices using keywords and Lucene queries.

• get_log_details: Retrieve the full un-truncated JSON of specific log events.

• analyze_service_health: Aggregate error rates, success rates, and HTTP status codes for a given service.

• scan_code_for_apis: Scans your local Spring Boot (Java) or Express (Node.js) project to dynamically discover REST endpoints.

• create_api_dashboard: Programmatically generates a Kibana dashboard visualizing the dynamically discovered endpoints using the Kibana Saved Objects API.

Installation & Production Setup

1. Ensure you have Node.js (v18+) installed.

2. Run npm install

3. Run npm run build

4. Copy .env.example to .env and configure your environment variables (or set them directly in your LLM Client setup).

Configuration Map

Usage with Claude Desktop / Cursor

Add the following configuration to your claude_desktop_config.json or Cursor MCP settings:

{
  "mcpServers": {
    "kibana-logs": {
      "command": "node",
      "args": ["/Users/sidhu/.gemini/antigravity/scratch/kibana-mcp-server/build/index.js"],
      "env": {
        "ELASTIC_URL": "https://your-bank-cluster:9200",
        "ELASTIC_API_KEY": "your_secure_api_key",
        "KIBANA_URL": "https://your-bank-kibana:5601"
      }
    }
  }
}

Security Best Practices for Enterprise

• Least Privilege: Do not grant your ELASTIC_API_KEY delete, put, or cluster-admin privileges. It only needs read on application indices, and all access to the Kibana Saved Objects API (to create dashboards).

• Data Masking: If your logs contain PII (Personally Identifiable Information), you should implement a regex mask in src/index.ts right before returning the logs to the AI payload.