Connect Kibana to Alibaba Cloud SLS via ES‑Compatible API Using Docker‑Compose

Overview

Alibaba Cloud Log Service (SLS) offers an Elasticsearch‑compatible API, allowing existing Kibana installations to query and visualize log data stored in SLS without changing the Kibana workflow.

Architecture

Kibana – visualization front‑end.

kproxy – a lightweight HTTP proxy that forwards Kibana requests to the SLS ES‑compatible endpoint.

Elasticsearch (7.17.3) – stores only Kibana metadata (index patterns, dashboards, etc.) because SLS Logstore does not support document updates.

The Elasticsearch node runs in single‑node mode with minimal resource allocation.

Deploy with Docker‑Compose

Prepare a working directory and create a data volume for Elasticsearch:

mkdir sls-kibana
cd sls-kibana
mkdir es_data

Create docker-compose.yml with the following content. Replace the placeholder values marked with # modify with your own credentials and project information.

version: '3'
services:
  es:
    image: elasticsearch:7.17.3
    environment:
      - "discovery.type=single-node"
      - "ES_JAVA_OPTS=-Xms2G -Xmx2G"
      - "ELASTIC_USERNAME=elastic"
      - "ELASTIC_PASSWORD=YOUR_ES_PASSWORD"   # modify
      - "xpack.security.enabled=true"
    volumes:
      - ./es_data:/usr/share/elasticsearch/data
    networks:
      - esnet

  kproxy:
    image: sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/kproxy:1.9d
    depends_on:
      - es
    environment:
      - ES_ENDPOINT=es:9200
      - SLS_ENDPOINT=https://YOUR_PROJECT.cn-huhehaote.log.aliyuncs.com/es/   # modify, must end with /es/
      - SLS_PROJECT=YOUR_PROJECT                                 # modify
      - SLS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_ID                     # modify
      - SLS_ACCESS_KEY_SECRET=YOUR_ACCESS_KEY_SECRET             # modify
    networks:
      - esnet

  kibana:
    image: kibana:7.17.3
    depends_on:
      - kproxy
    environment:
      - ELASTICSEARCH_HOSTS=http://kproxy:9201
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=YOUR_ES_PASSWORD               # same as above
      - XPACK_MONITORING_UI_CONTAINER_ELASTICSEARCH_ENABLED=true
    ports:
      - "5601:5601"
    networks:
      - esnet

networks:
  esnet:
    driver: bridge

Start the stack: docker compose up -d Verify that the containers are running:

docker compose ps

Access Kibana

Open a web browser at http://HOST_IP:5601 and log in with the Elasticsearch credentials defined above.

Configure Index Pattern

In Kibana navigate to Stack Management → Index Patterns → Create Index Pattern . Because SLS does not expose hidden indices, you must create the pattern manually using the exact format ${project}.${logstore} (wildcards are not supported). After creation, the Discover view will show log entries from the specified Logstore.

Querying and Visualization

Kibana’s query bar supports both KQL and Lucene syntax against the SLS ES‑compatible endpoint. You can run simple host queries or complex filters. Dashboards are built by selecting fields for the X‑axis, Y‑axis, and optional breakdowns (e.g., by status).

FAQ (Technical)

Why can’t I see Logstore data? The Index Pattern must be created manually with the full ${project}.${logstore} name.

Why is there no preview when creating an Index Pattern? The UI only shows a preview after a valid full name is entered.

Are wildcards supported? No. Full names are required.

Why is there no hint on the right side of the Index Pattern creation page? Possible causes: (a) the kproxy SLS endpoint is incorrect (must end with /es/); (b) the AccessKey lacks read permission for the Logstore.

Can a single Kibana instance access multiple SLS projects? Yes. Define additional variables with numeric suffixes (e.g., SLS_PROJECT2, SLS_ENDPOINT2, SLS_ACCESS_KEY_ID2, SLS_ACCESS_KEY_SECRET2) in the kproxy service.

References

SLS ES Compatibility Overview – https://help.aliyun.com/zh/sls/user-guide/compatibility-between-log-service-and-elasticsearch

Using Kibana with the SLS ES‑compatible API – https://help.aliyun.com/zh/sls/user-guide/use-kibana-to-access-the-elasticsearch-compatible-api-of-log-service