Kibana Logs rotation

(Meenakshi Jindal) #1

How can we enable the logs file rotation for Kibana logs in Production?

I tried to create the logging.yml file in config folder, but does not seems to be working.

  • Meenakshi

(Tim Sullivan) #2

Kibana doesn't handle log rotation, but it is built to work with an external process that rotates logs, such as logrotate. In logrotate.conf

As per you can make Kibana reload the configuration by sending the SIGHUP signal to the Kibana process.

(Tim Sullivan) #3

Adding more detail, since this is not documented very well yet.

First, set the pid.file option in kibana.yml to have Kibana create a process ID file. For example, to set it as "pid.log", add:

pid.file: "pid.log"

If you're going to use logrotate, add an entry to logrotate.conf, such as:

/var/log/kibana {
    /bin/kill -HUP $(cat /usr/share/kibana/pid.log 2>/dev/null) 2>/dev/null

Note that I haven't tried this myself, so let me know if it works, or what you did to get it working.

(Meenakshi Jindal) #4

I tries this conf in logrotate:

/path/to/kibana.log {
rotate 7

Seems to be working. No need to do the step -
/bin/kill -HUP $(cat /usr/share/kibana/pid.log 2>/dev/null) 2>/dev/null

(Tim Sullivan) #5

If you don't include that SIGHUP step, a problem could happen that Kibana keeps logging to an old log file.

Kibana will keep writing to /path/to/kibana.log, and the open file handler is based on the file's inode. When logrotate renames the file to /path/to/kibana.log.1 or whatver, the inode stays the same, so Kibana needs to be told to reload the configuration. The SIGNUP signal does that, and gets Kibana to re-open /path/to/kibana.log, which will be a fresh new file thanks to logrotate.

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.