Packages using systemd should log to /var/log/kibana

[LeeDr]

On Ubuntu 15.10 I installed http://download.elasticsearch.org/kibana/kibana-snapshot/kibana_4.5.0-snapshot_amd64.deb and did not get a /var/log/kibana directory created. Kibana logs are going in /var/log/syslog instead. I know they were going into /var/log/kibana at one time.

[spalger]

Any idea when this was introduced?

[LeeDr]

I'm not sure, but I had a script on my Ubuntu VM that had previously worked and it was checking the log like this;
grep "plugin:elasticsearch.*green" /var/log/kibana/kibana.stdout

So I know at one time it did. OHHH, but at one point I was doing the steps to add the repo and doing apt-get install kibana but now I've done dpkg -i <the .deb file>. So maybe that doesn't do the same steps?

But I'm installing elasticsearch the same dpkg way and it IS writing logs to /var/log/elasticsearch/

[jbudz]

@LeeDr are you using systemd? It has a built in logger that's used instead. journalctl -u kibana.service

[LeeDr]

Ah yes, you're right. I think we're OK to close this. Just wondering if there's any docs referring to /var/log/kibana that need any adjustment now or soon. In my case, I upgraded my Ubuntu to 15.10 because that's where the jdk 8 is supported and that's required for the 5.0 release.

[jbudz]

Just took a look around and didn't see any references. I'm going to close this for now, we can reopen if something comes up.

[cwurm]

I helped some folks set up Elastic lately and installing Kibana 5.1 with the .deb on Ubuntu 16.04 using systemd also led to Kibana logging into /var/log/syslog.

Given that Elasticsearch is logging nicely into /var/log/elasticsearch it would be nice to have consistency across the stack.

Re-opening this as @jbudz suggested - I'm also happy to open a new issue, let me know.

[Bargs]

I agree with @cwurm. I ran into the same issue testing 5.3. In fact our current docs say:

information will be written in the log files located in /var/log/kibana/

Which appears to be false. There's no mention of journalctl on the page at all.

[PhaedrusTheGreek]

Seeing the same thing in 5.5. under Centos 7 / Systemd. There's no /var/log/kibana directory, and logs are going to /var/log/messages

[dadoonet]

Can we fix the docs in the meantime? https://www.elastic.co/guide/en/kibana/current/deb.html#deb-running-systemd

May be advice using sudo journalctl -f instead?

[prupert]

It appears that #16372 will fix this issue, this will make packaged Kibana installations log to /var/log/kibana, yay!

[dspruell]

I'm not totally clear on what the status of this issue is, couldn't tell if #16372 was merged before being closed. In any case I'm still seeing the issue with Kibana 6.2.4 from the Elastic APT repo. Upon startup using systemd on Debian 9 there is no logging to /var/log/kibana and no mention of the log path in the installed /etc/kibana/kibana.yml. There is logging visible from jounalctl(1) and in var/log/syslog. I agree with @cwurm that consistency across all the stack with each component having their own dedicated log directories would be ideal so it would be nice to have reality match what is documented (as opposed to vice versa).

[jbudz]

16372 was closed, and this issue is still valid.

[deepybee]

This is also affecting RPM builds, which are pushing to /var/log/messages when spawned with systemd.

[deepybee]

This is from an RPM build, but it seems our systemd build jobs make no explicit statement on default log path;

ExecStart=/usr/share/kibana/bin/kibana "-c /etc/kibana/kibana.yml"

Contrastingly, our init scripts explicitly redirect console output as expected:

  # Run the program!

  chroot --userspec "$user":"$group" "$chroot" sh -c "

    cd \"$chdir\"
    exec \"$program\" $args
  " >> /var/log/kibana/kibana.stdout 2>> /var/log/kibana/kibana.stderr &

[archon810]

I installed Kibana from a package manager on OpenSUSE 15.1, and it didn't log to /var/log/kibana by default. In fact, it didn't even create the directory. It also didn't create /var/log/kibana.log when I manually specified the log destination, and I had to touch and chown the file myself before it started working.

What am I missing?

Kibana 7.6.2 from https://artifacts.elastic.co/packages/7.x/yum.

Thanks.