Kibana Logs rotation

How can we enable the logs file rotation for Kibana logs in Production?

I tried to create the logging.yml file in config folder, but does not seems to be working.

  • Meenakshi

Kibana doesn't handle log rotation, but it is built to work with an external process that rotates logs, such as logrotate. In logrotate.conf

As per https://github.com/elastic/kibana/issues/4407 you can make Kibana reload the configuration by sending the SIGHUP signal to the Kibana process.

Adding more detail, since this is not documented very well yet.

First, set the pid.file option in kibana.yml to have Kibana create a process ID file. For example, to set it as "pid.log", add:

pid.file: "pid.log"

If you're going to use logrotate, add an entry to logrotate.conf, such as:

/var/log/kibana {
    missingok
    notifempty
    sharedscripts
    postrotate
    /bin/kill -HUP $(cat /usr/share/kibana/pid.log 2>/dev/null) 2>/dev/null
    endscript
}

Note that I haven't tried this myself, so let me know if it works, or what you did to get it working.

2 Likes

I tries this conf in logrotate:

/path/to/kibana.log {
daily
rotate 7
copytruncate
compress
missingok
notifempty
}

Seems to be working. No need to do the step -
/bin/kill -HUP $(cat /usr/share/kibana/pid.log 2>/dev/null) 2>/dev/null

1 Like

If you don't include that SIGHUP step, a problem could happen that Kibana keeps logging to an old log file.

Kibana will keep writing to /path/to/kibana.log, and the open file handler is based on the file's inode. When logrotate renames the file to /path/to/kibana.log.1 or whatver, the inode stays the same, so Kibana needs to be told to reload the configuration. The SIGNUP signal does that, and gets Kibana to re-open /path/to/kibana.log, which will be a fresh new file thanks to logrotate.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.