# Kibana Log Rotation

**URL:** <https://discuss.elastic.co/t/kibana-log-rotation/139764>\
**Category:** Kibana\
**Created:** [July 12, 2018, 1:30pm UTC](https://discuss.elastic.co/t/kibana-log-rotation/139764 "2018-07-12T13:30:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [July 12, 2018, 1:30pm UTC](https://discuss.elastic.co/t/kibana-log-rotation/139764/1 "2018-07-12T13:30:38Z")

</div>

I have set `logging.dest`in `kibana.yml`, but the log file grows rapidly to the point where in just a few weeks some text editors (e.g. Notepad++) can't open the file because its so big.

Is there a way to rotate the log file so that, say, each day the log file name is changed?

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [July 12, 2018, 3:18pm UTC](https://discuss.elastic.co/t/kibana-log-rotation/139764/2 "2018-07-12T15:18:48Z")

</div>

There is nothing built into kibana for rotating log files. However, there are many OS level commands for managing logs. For example, on linux give [logrotate](https://linux.die.net/man/8/logrotate) a try.

---

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [July 13, 2018, 2:56pm UTC](https://discuss.elastic.co/t/kibana-log-rotation/139764/3 "2018-07-13T14:56:25Z")

</div>

I have Kibana installed on a Windows environment, is there a Windows equivalent of this you recommend?  
Thanks

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [July 13, 2018, 3:20pm UTC](https://discuss.elastic.co/t/kibana-log-rotation/139764/4 "2018-07-13T15:20:24Z")

</div>

I do not have a recommendation for windows log rotation

---

<div class="post-metadata">

**Author:** ![Micah\_Hunsberger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_hunsberger/32/147436_2.png) [@Micah\_Hunsberger](https://discuss.elastic.co/u/Micah_Hunsberger)\
**Post date:** [August 2, 2018, 7:27pm UTC](https://discuss.elastic.co/t/kibana-log-rotation/139764/5 "2018-08-02T19:27:45Z")

</div>

Kibana uses the file handle, and doesn't just append to the configured filename, which means Kibana can keep writing to the file even after renaming or moving the log file. So to split the logs from the log file you have to essentially cut/paste the contents into a new file. Since I just wanted each day's logs to get placed into `kibana-yyy-mm-dd.log`, a PowerShell script that runs with Task Scheduler every night does the trick. In case anyone else comes across the same problem, here's my simple script, but you'll have to change it depending on how often you want the logs rotated and where Kibana is logging to.

```auto
$File = "C:\path\to\kibana.log"

# yesterday's date as a string
$ds = (Get-Date).AddDays(-1).ToString("yyyy-MM-dd")

# kibana-[yesterday].log
$newfn = [System.IO.Path]::Combine([System.IO.Path]::GetDirectoryName($File), [System.IO.Path]::GetFileNameWithoutExtension($File) + "-$ds" ) + [System.IO.Path]::GetExtension($File)

# copy from kibana.log
$old_logs = Get-Content -Path $File -Raw

# cut from kibana.log
Clear-Content -Path $File -Force

# paste to kibana-[yesterday].log
Set-Content -Value $old_logs -Path $newfn -Force

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 30, 2018, 7:27pm UTC](https://discuss.elastic.co/t/kibana-log-rotation/139764/6 "2018-08-30T19:27:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
