How to manage the Kibana service with systemctl in Linux

Managing the Kibana service with systemd lets an operator start the web UI, take it offline for maintenance, apply configuration changes, and control whether it returns after a reboot. Package-based Linux installs expose this control through the kibana.service unit.

DEB and RPM packages install a systemd unit that runs as the kibana user, uses KBN_PATH_CONF=/etc/kibana, accepts optional environment files from /etc/default/kibana and /etc/sysconfig/kibana, and writes standard output to the journal. Those package defaults make systemctl and journalctl the normal service-control tools for self-managed hosts.

An active (running) service state proves that the Kibana process started, not that every dashboard and API route is ready for users. Fresh secured installs can still wait at the enrollment or interactiveSetup stage until Elasticsearch connection settings are valid, so pair service checks with the Kibana status API when application readiness matters.

Steps to manage the Kibana service with systemctl in Linux:

Check the current Kibana service state.

$ sudo systemctl status kibana.service --no-pager
● kibana.service - Kibana
     Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-06-18 14:22:09 UTC; 18s ago
       Docs: https://www.elastic.co
   Main PID: 8123 (node)
      Tasks: 11 (limit: 28672)
     Memory: 642.4M (peak: 650.1M)
        CPU: 9.481s
     CGroup: /system.slice/kibana.service
             └─8123 /usr/share/kibana/node/bin/node /usr/share/kibana/src/cli/dist
##### snipped #####

The Loaded line shows both the unit file path and boot-start state. disabled; preset: enabled means the vendor preset allows boot start, but the local host has not enabled it yet.

Reload the systemd manager after installing the package or changing a unit override.
```
$ sudo systemctl daemon-reload
```
No output indicates systemd accepted the manager reload.
Start the Kibana service.
```
$ sudo systemctl start kibana.service
```
The command normally prints no success output. Password-protected Kibana keystores need KBN_KEYSTORE_PASSPHRASE_FILE or KEYSTORE_PASSWORD in the service environment before non-interactive service starts.
Related: How to create a Kibana keystore
Confirm that Kibana is running.
```
$ systemctl is-active kibana.service
active
```
Use the full status output or the journal when this command returns failed, activating, or inactive instead of active.

Enable Kibana to start automatically at boot.

$ sudo systemctl enable kibana.service
Created symlink /etc/systemd/system/multi-user.target.wants/kibana.service -> /usr/lib/systemd/system/kibana.service.

Confirm the boot-start state.

$ systemctl is-enabled kibana.service
enabled

Restart Kibana after changing its configuration, keystore-backed settings, or service environment.
```
$ sudo systemctl restart kibana.service
```
Restart after edits to /etc/kibana/kibana.yml, secure settings loaded from the keystore, or package environment files. Run daemon-reload first when a unit override under /etc/systemd/system/kibana.service.d/ changed.
Related: How to set the Kibana server host
Related: How to connect Kibana to Elasticsearch

Review recent Kibana service logs in the journal.

$ sudo journalctl --unit=kibana.service --since "10 minutes ago" --no-pager
Jun 18 14:22:09 kibana-01 systemd[1]: Started kibana.service - Kibana.
Jun 18 14:22:12 kibana-01 kibana[8123]: [2026-06-18T14:22:12.412+00:00][INFO ][root] Kibana is starting
Jun 18 14:22:17 kibana-01 kibana[8123]: [2026-06-18T14:22:17.803+00:00][INFO ][http.server.Preboot] http server running at http://localhost:5601
Jun 18 14:22:17 kibana-01 kibana[8123]: [2026-06-18T14:22:17.851+00:00][INFO ][preboot] "interactiveSetup" plugin is holding setup: Validating Elasticsearch connection configuration
##### snipped #####

Package defaults send Kibana standard output to the systemd journal. Use the unfiltered journal when startup loops, enrollment prompts, or plugin errors need review.
Related: How to set Kibana logging levels

Stop Kibana when the web UI and APIs should be offline.
```
$ sudo systemctl stop kibana.service
```
Stopping the service makes Kibana unavailable until it is started again or the host reaches a boot target where the service is enabled.

Confirm that the service stopped.

$ systemctl is-active kibana.service
inactive

Disable automatic startup when Kibana should remain manual after reboot.
```
$ sudo systemctl disable kibana.service
Removed "/etc/systemd/system/multi-user.target.wants/kibana.service".
```
Use sudo systemctl disable --now kibana.service only when the service should be disabled and stopped in one operation.