Kibana Log Rotation

Elastic Stack Kibana
1

I have set logging.destin kibana.yml, but the log file grows rapidly to the point where in just a few weeks some text editors (e.g. Notepad++) can't open the file because its so big.

Is there a way to rotate the log file so that, say, each day the log file name is changed?

2

There is nothing built into kibana for rotating log files. However, there are many OS level commands for managing logs. For example, on linux give logrotate a try.

3

I have Kibana installed on a Windows environment, is there a Windows equivalent of this you recommend?
Thanks

4

I do not have a recommendation for windows log rotation

5

Kibana uses the file handle, and doesn't just append to the configured filename, which means Kibana can keep writing to the file even after renaming or moving the log file. So to split the logs from the log file you have to essentially cut/paste the contents into a new file. Since I just wanted each day's logs to get placed into kibana-yyy-mm-dd.log, a PowerShell script that runs with Task Scheduler every night does the trick. In case anyone else comes across the same problem, here's my simple script, but you'll have to change it depending on how often you want the logs rotated and where Kibana is logging to.

$File = "C:\path\to\kibana.log"

# yesterday's date as a string
$ds = (Get-Date).AddDays(-1).ToString("yyyy-MM-dd")

# kibana-[yesterday].log
$newfn = [System.IO.Path]::Combine([System.IO.Path]::GetDirectoryName($File), [System.IO.Path]::GetFileNameWithoutExtension($File) + "-$ds" ) + [System.IO.Path]::GetExtension($File)

# copy from kibana.log
$old_logs = Get-Content -Path $File -Raw

# cut from kibana.log
Clear-Content -Path $File -Force

# paste to kibana-[yesterday].log
Set-Content -Value $old_logs -Path $newfn -Force
2 Likes
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.