Kibana Logs rotation

Elastic Stack Kibana
1

How can we enable the logs file rotation for Kibana logs in Production?

I tried to create the logging.yml file in config folder, but does not seems to be working.

  • Meenakshi
2

Kibana doesn't handle log rotation, but it is built to work with an external process that rotates logs, such as logrotate. In logrotate.conf

As per https://github.com/elastic/kibana/issues/4407 you can make Kibana reload the configuration by sending the SIGHUP signal to the Kibana process.

1 Like
3

Adding more detail, since this is not documented very well yet.

First, set the pid.file option in kibana.yml to have Kibana create a process ID file. For example, to set it as "pid.log", add:

pid.file: "pid.log"

If you're going to use logrotate, add an entry to logrotate.conf, such as:

/var/log/kibana {
    missingok
    notifempty
    sharedscripts
    postrotate
    /bin/kill -HUP $(cat /usr/share/kibana/pid.log 2>/dev/null) 2>/dev/null
    endscript
}

Note that I haven't tried this myself, so let me know if it works, or what you did to get it working.

4 Likes
4

I tries this conf in logrotate:

/path/to/kibana.log {
daily
rotate 7
copytruncate
compress
missingok
notifempty
}

Seems to be working. No need to do the step -
/bin/kill -HUP $(cat /usr/share/kibana/pid.log 2>/dev/null) 2>/dev/null

1 Like
5

If you don't include that SIGHUP step, a problem could happen that Kibana keeps logging to an old log file.

Kibana will keep writing to /path/to/kibana.log, and the open file handler is based on the file's inode. When logrotate renames the file to /path/to/kibana.log.1 or whatver, the inode stays the same, so Kibana needs to be told to reload the configuration. The SIGNUP signal does that, and gets Kibana to re-open /path/to/kibana.log, which will be a fresh new file thanks to logrotate.

1 Like
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.