How to set Kibana logging levels

Changing Kibana logging levels controls how much operational detail ends up in the systemd journal, making troubleshooting easier while keeping routine logs readable.

When Kibana starts, it reads /etc/kibana/kibana.yml and builds a logger hierarchy, with logging.root.level setting the default verbosity across the application unless overridden by a more specific logger.

Verbose levels such as debug and trace can grow logs quickly and may capture sensitive request details, so higher verbosity is best kept temporary. Invalid YAML or incorrect keys can also prevent the kibana service from starting cleanly after a restart.

1. Create a backup copy of the Kibana configuration file.

   $ sudo cp -a /etc/kibana/kibana.yml /etc/kibana/kibana.yml.bak

2. Open the Kibana configuration file.

   $ sudo nano /etc/kibana/kibana.yml

3. Set logging.root.level to the desired verbosity.

   logging.root.level: info

   Common Kibana levels include fatal, error, warn, info, debug, and trace.

   Higher verbosity can increase disk usage rapidly; revert to a lower level (such as info or warn) after troubleshooting.

4. Restart the kibana service to apply the change.

   $ sudo systemctl restart kibana

   Related: How to manage the Kibana service with systemctl in Linux

5. Confirm the kibana service is active after the restart.

   $ sudo systemctl status kibana --no-pager
   ● kibana.service - Kibana
        Loaded: loaded (/lib/systemd/system/kibana.service; enabled; vendor preset: enabled)
        Active: active (running) since Mon 2026-01-05 09:12:34 UTC; 12s ago
   ##### snipped #####

6. Review recent Kibana log output in the journal for the expected verbosity.

   $ sudo journalctl -u kibana -n 25 --no-pager
   Jan 05 09:12:34 server kibana[1234]: [2026-01-05T09:12:34.567+00:00][INFO ][root] Kibana is starting
   Jan 05 09:12:36 server kibana[1234]: [2026-01-05T09:12:36.102+00:00][INFO ][plugins-system.standard] Setting up [120] plugins: ##### snipped #####
   Jan 05 09:12:45 server kibana[1234]: [2026-01-05T09:12:45.880+00:00][INFO ][http.server.Preboot] http server running at http://0.0.0.0:5601