How to Connect Kibana to Alibaba Cloud SLS via ES Compatibility with Docker‑Compose

Now you can use Kibana to query and visualize data stored in Alibaba Cloud Log Service (SLS) through its Elasticsearch‑compatible API.

Deployment Architecture

The architecture includes three components: Kibana for visualization, a proxy (kproxy) that forwards Kibana requests to SLS’s ES‑compatible endpoint, and a lightweight Elasticsearch instance that stores Kibana’s metadata.

Preparation

Install Docker and Docker‑Compose. The following steps also work with Podman‑Compose.

Create Directories

mkdir sls-kibana
cd sls-kibana
mkdir es_data

docker‑compose.yml

version: '3'
services:
  es:
    image: elasticsearch:7.17.3
    environment:
      - "discovery.type=single-node"
      - "ES_JAVA_OPTS=-Xms2G -Xmx2G"
      - "ELASTIC_USERNAME=elastic"
      - "ELASTIC_PASSWORD=YOUR_ES_PASSWORD"
      - "xpack.security.enabled=true"
    volumes:
      - ./data:/usr/share/elasticsearch/data
    networks:
      - es717net

  kproxy:
    image: sls-registry.cn-hangzhou.cr.aliyuncs.com/kproxy/kproxy:1.9d
    depends_on:
      - es
    environment:
      - ES_ENDPOINT=es:9200
      - SLS_ENDPOINT=https://YOUR_PROJECT.log.aliyuncs.com/es/
      - SLS_PROJECT=YOUR_PROJECT
      - SLS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_ID
      - SLS_ACCESS_KEY_SECRET=YOUR_ACCESS_KEY_SECRET
    networks:
      - es717net

  kibana:
    image: kibana:7.17.3
    depends_on:
      - kproxy
    environment:
      - ELASTICSEARCH_HOSTS=http://kproxy:9201
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=YOUR_ES_PASSWORD
      - XPACK_MONITORING_UI_CONTAINER_ELASTICSEARCH_ENABLED=true
    ports:
      - "5601:5601"
    networks:
      - es717net

networks:
  es717net:
    ipam:
      driver: default

Start Services

docker compose up -d

docker compose ps

Access Kibana

Open a browser at http://<em>IP_ADDRESS</em>:5601 and log in with the Kibana credentials.

Configure Index Pattern

In Stack Management → Index Patterns, create a pattern using the exact format ${project}.${logstore} (wildcards are not supported).

Query Logstore

Use Kibana’s query bar with either KQL or Lucene syntax to search logs. Example simple host query and more complex filters are supported.

Create Visualizations

Navigate to Dashboard, click “Create Dashboard”, add a visualization, set the X‑axis (time) and Y‑axis (record count), and optionally break down by status to see status distribution.

FAQ

Why can’t I see the Logstore in Kibana? You must manually create the Index Pattern with the exact ${project}.${logstore} format.

Why is there no prompt when creating an Index Pattern? The prompt appears only after entering a correct pattern.

Does the Index Pattern support wildcards? No, it requires the full ${project}.${logstore} string.

Why is there no right‑hand tip when creating the pattern? Possible reasons: incorrect ES‑compatible endpoint or missing read permissions for the AccessKey.

Can I access multiple SLS projects from one Kibana instance? Yes, configure additional projects in kproxy with numbered variable suffixes (e.g., SLS_PROJECT2, SLS_ENDPOINT2, etc.).

Summary

This article demonstrates how to connect Kibana to Alibaba Cloud SLS via its Elasticsearch‑compatible API, covering deployment, configuration, querying, visualization, and troubleshooting. It is suitable for users accustomed to Kibana who store logs in SLS, as well as for those looking to replace a traditional ELK stack with a serverless, cost‑effective solution.

References

SLS Compatibility with ES – https://help.aliyun.com/zh/sls/user-guide/compatibility-between-log-service-and-elasticsearch

Use Kibana to Access the ES‑Compatible API of Log Service – https://help.aliyun.com/zh/sls/user-guide/use-kibana-to-access-the-elasticsearch-compatible-api-of-log-service