How to set Kibana logging levels

Changing Kibana logging levels controls how much startup, plugin, and request detail the server records while you troubleshoot. Raising the level temporarily makes it easier to see what Kibana is doing when the UI is slow to come up, plugins fail to initialize, or connections to Elasticsearch are misbehaving.

Kibana reads its logging configuration from kibana.yml at startup. The logging.root.level setting defines the default threshold for the whole application unless you add more specific logger overrides, and the current supported levels are off, fatal, error, warn, info, debug, trace, and all.

This guide uses the common package-based Linux layout with /etc/kibana/kibana.yml and systemctl. Debian and RPM installs usually write service logs under /var/log/kibana, while Docker sends them to docker logs and archive installs use $KIBANA_HOME/logs. Kibana validates logging settings at startup, so unsupported values or broken YAML can stop the service from coming up cleanly.

Related: How to check Kibana status

Steps to set Kibana logging levels:

Create a backup of the Kibana configuration file.

$ sudo cp -a /etc/kibana/kibana.yml /etc/kibana/kibana.yml.bak

Open the Kibana configuration file in an editor.
```
$ sudo nano /etc/kibana/kibana.yml
```
Set logging.root.level to the verbosity that matches your troubleshooting need.
```
logging.root.level: debug
```
Supported current levels are off, fatal, error, warn, info, debug, trace, and all. The default level is info.

Higher levels can expose request details and produce a large volume of logs. Invalid YAML or an unsupported level prevents Kibana from starting because the logging configuration is validated at startup.
Restart the kibana service to apply the change.
```
$ sudo systemctl restart kibana
```
Related: How to manage the Kibana service with systemctl in Linux
Confirm that systemd sees the service as running after the restart.
```
$ sudo systemctl is-active kibana
active
```

Check for the expected verbosity in the Kibana logs.

$ sudo tail -n 50 /var/log/kibana/kibana.log | rg -m 4 '\[DEBUG\]'
[2026-04-02T13:43:20.671+00:00][DEBUG][root] prebooting root
[2026-04-02T13:43:20.671+00:00][DEBUG][server] prebooting server
[2026-04-02T13:43:20.752+00:00][DEBUG][plugins-discovery] Discovering plugins...
[2026-04-02T13:43:30.409+00:00][DEBUG][plugins.taskManagerDependencies] Initializing plugin

If your deployment does not use /var/log/kibana, read the same entries from docker logs kibana or from $KIBANA_HOME/logs instead.

Return the setting to a lower level when the troubleshooting session is finished, then restart Kibana again.
```
logging.root.level: info
```
```
$ sudo systemctl restart kibana
```