# Kibana Logs rotation

**URL:** <https://discuss.elastic.co/t/kibana-logs-rotation/66441>\
**Category:** Kibana\
**Created:** [November 17, 2016, 6:29pm UTC](https://discuss.elastic.co/t/kibana-logs-rotation/66441 "2016-11-17T18:29:29Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Meenakshi.Jindal](https://avatars.discourse-cdn.com/v4/letter/m/848f3c/32.png) [@Meenakshi.Jindal](https://discuss.elastic.co/u/Meenakshi.Jindal)\
**Post date:** [November 17, 2016, 6:29pm UTC](https://discuss.elastic.co/t/kibana-logs-rotation/66441/1 "2016-11-17T18:29:29Z")

</div>

How can we enable the logs file rotation for Kibana logs in Production?

I tried to create the logging.yml file in config folder, but does not seems to be working.

- Meenakshi

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [November 17, 2016, 8:42pm UTC](https://discuss.elastic.co/t/kibana-logs-rotation/66441/2 "2016-11-17T20:42:32Z")

</div>

Kibana doesn't handle log rotation, but it is built to work with an external process that rotates logs, such as logrotate. In logrotate.conf

As per [https://github.com/elastic/kibana/issues/4407](https://github.com/elastic/kibana/issues/4407) you can make Kibana reload the configuration by sending the SIGHUP signal to the Kibana process.

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [November 17, 2016, 9:01pm UTC](https://discuss.elastic.co/t/kibana-logs-rotation/66441/3 "2016-11-17T21:01:47Z")

</div>

Adding more detail, since this is not documented very well yet.

First, set the `pid.file` option in kibana.yml to have Kibana create a process ID file. For example, to set it as "pid.log", add:

```auto
pid.file: "pid.log"

```

If you're going to use logrotate, add an entry to `logrotate.conf`, such as:

```auto
/var/log/kibana {
    missingok
    notifempty
    sharedscripts
    postrotate
    /bin/kill -HUP $(cat /usr/share/kibana/pid.log 2>/dev/null) 2>/dev/null
    endscript
}

```

Note that I haven't tried this myself, so let me know if it works, or what you did to get it working.

---

<div class="post-metadata">

**Author:** ![Meenakshi.Jindal](https://avatars.discourse-cdn.com/v4/letter/m/848f3c/32.png) [@Meenakshi.Jindal](https://discuss.elastic.co/u/Meenakshi.Jindal)\
**Post date:** [November 18, 2016, 9:49pm UTC](https://discuss.elastic.co/t/kibana-logs-rotation/66441/4 "2016-11-18T21:49:45Z")

</div>

I tries this conf in logrotate:

/path/to/kibana.log {  
daily  
rotate 7  
copytruncate  
compress  
missingok  
notifempty  
}

Seems to be working. No need to do the step -  
/bin/kill -HUP $(cat /usr/share/kibana/pid.log 2\>/dev/null) 2\>/dev/null

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [November 19, 2016, 12:10am UTC](https://discuss.elastic.co/t/kibana-logs-rotation/66441/5 "2016-11-19T00:10:22Z")

</div>

If you don't include that `SIGHUP` step, a problem could happen that Kibana keeps logging to an old log file.

Kibana will keep writing to `/path/to/kibana.log`, and the open file handler is based on the file's inode. When logrotate renames the file to `/path/to/kibana.log.1` or whatver, the inode stays the same, so Kibana needs to be told to reload the configuration. The `SIGNUP` signal does that, and gets Kibana to re-open `/path/to/kibana.log`, which will be a fresh new file thanks to logrotate.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2016, 12:10am UTC](https://discuss.elastic.co/t/kibana-logs-rotation/66441/6 "2016-12-17T00:10:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.