Kibana logs

[irivas95]

Hi,
I have been trying for a while to configure a logrotate file to rotate my kibana logs(version 7.16.3),without success. I need my logs to rotate daily and delete logs older than 7 days. The configuration file I am using is as follows:

/var/log/kibana/kibana.log {
    create 644 kibana kibana
    daily
    rotate 7
    dateext
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
        /bin/kill -USR1 `cat /run/kibana/kibana.pid 2>/dev/null` 2>/dev/null || true
    endscript
}

Does anyone know what I am doing wrong?
thanks in advance

[jsanz (Jorge Sanz)]

Why not using Kibana built-in logging features?

I just tested this sample configuration and works as expected:

logging:
  appenders:
    console-meta:
      type: console
      layout:
        type: pattern
        pattern: "[%date] [%level] [%logger] [%meta] %message"
        highlight: true
    rolling-file:
      type: rolling-file
      fileName: /usr/share/kibana/logs/kibana.log
      policy:
        type: time-interval
        interval: 60s
        modulate: true
      strategy:
        type: numeric
        pattern: '-%i'
        max: 10
      layout:
        type: pattern
        pattern: "[%date] [%level] [%logger] [%meta] %message"
  root:
    appenders: [console-meta, rolling-file]
    level: info

[irivas95]

Hi,
Thank you for your reply.
I am using kibana version 7.16.3 and it does not have this feature so I am forced to use logrotate.

[jsanz (Jorge Sanz)]

Just tested the same configuration I shared on a 7.16.2 and it also works just adding the default appender to the root.appenders key.

Documentation and examples are here on how to set up logging:

Logging settings in Kibana | Kibana Guide [7.16] | Elastic

It's true it does not mention the file rolling appender as it does in newer versions but it is available. Sorry if that confused you.

[irivas95]

thank you for your reply.
One more question, should this configuration be included in kibana.yml or in a separate file like elasticsearch's log4j2.properties, which then needs to be referenced in kibana.yml?

[jsanz (Jorge Sanz)]

It should be included in the kibana.yml file or passed through environment variables as any other Kibana setting.

[irivas95]

thank you again for your reply.
I have done a test like yours and it works.
Do you know if there is any way to add the date to the pattern I have tried this, but it is not working for me.

logging:
  appenders:
    console-meta:
      type: console
      layout:
        type: pattern
        pattern: "[%date] [%level] [%logger] [%meta] %message"
        highlight: true
    rolling-file:
      type: rolling-file
      fileName: /var/log/kibana/kibana.log
      policy:
        type: time-interval
        interval: 24h
        modulate: true
      strategy:
        type: numeric
        pattern: '-%d{yyyy-MM-dd}-%i'
        max: 7
      layout:
        type: pattern
        pattern: "[%date] [%level] [%logger] [%meta] %message"
  root:
    appenders: [default, console-meta, rolling-file]
    level: info

and the result is this

[jsanz (Jorge Sanz)]

@irivas95

Do you know if there is any way to add the date to the pattern

Unfortunately that feature is not yet implemented. There's a tracking issue in case you want to subscribe and stay updated, add your own feedback and so on.

[Logging] Add date-pattern file naming during log-rotation

[irivas95]

thank you for everything, it has been very helpful.