Kibana logs

Elastic Stack Kibana
1

Hi All
I am trying to run Kibana and externalize logging with no success. The additional complexity I am dealing with is Docker. I am able to run the dockerized image of Kibana with an external config file.

logging.dest: /opt/kibana/log/kibana.log --> I have volume mapped the destination folder to the host

When I start Kibana it errors out with the following error:

events.js:85
      throw er; // Unhandled 'error' event
            ^
Error: EACCES, open '/opt/kibana/log/kibana.log'
    at Error (native)

Any ideas what is happening?

2

Looks like it doesn't have access to that file.
Can you check that it's mounted and you can write to it when the container is up?

3

Thanks for your response. Yes the directory is on the host where kibana is running. And there seems to be some permissions issue. Not sure why. May be I should explicitly give it a :rw ? in the docker-compose script? I checked and could'nt find an example for docker. Any ideas?

4

Sounds like you need to give it rw, yes.

5

Tried. Still no luck. Is there any documentation on how to? The elastic search doc site mentions in settings to set logging.dest. But can you give me an example?
I was able to set the logging.dest from within the docker container to write to the host using the -l option
but got the following error
FATAL { [Error: listen EADDRINUSE]
cause: { [Error: listen EADDRINUSE] code: 'EADDRINUSE', errno: 'EADDRINUSE', syscall: 'listen' },
isOperational: true,
code: 'EADDRINUSE',
errno: 'EADDRINUSE',
syscall: 'listen' }
But it created the log file. Any clues?

6

This sounds like it's really a docker setup issue, so I don't think we can offer a ton of guidance. In my experience with docker, permissions issues tended to crop up when you have a mismatch between the users inside the container vs the host. You probably want to figure out what user Kibana is running as inside the container, and what user/group owns the directory you're trying to write to on the host. What matters here is that the UID and GID match inside and outside of the container, it's not enough for just the names to match.

That said, it's just my gut reaction and I haven't worked with docker in awhile, so my recommendations could be out of date.

7

I actually had the same problem and i commented out the line logging.dest: in my kibana.yaml file. Then my kibana started but with some errors on the dashboard related to elasticsearch. And ofcourse now i have to figure out where the logs are redirected by kibana.