How to manage the Kibana service with systemctl in Linux

Managing the Kibana service controls access to dashboards and APIs during upgrades, maintenance windows, and recovery after failures. Quick start/stop/restart operations reduce downtime and help keep the web UI responsive when changes are applied.

On most Linux systems, Kibana is installed as a systemd unit named kibana.service. The systemctl command manages the service lifecycle, while journalctl shows startup progress and runtime errors captured by the system journal.

Service restarts interrupt active sessions and may temporarily show Kibana server is not ready yet while plugins initialize and the connection to Elasticsearch is established. Configuration is commonly stored in /etc/kibana/kibana.yml, and changes to settings like server.host or server.port require a restart to take effect.

Steps to manage the Kibana service with systemctl in Linux:

Check the Kibana service status.

$ sudo systemctl status kibana --no-pager --full | head -n 12
● kibana.service - Kibana
     Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-01-08 00:22:45 UTC; 12min ago
       Docs: https://www.elastic.co
   Main PID: 57170 (node)
      Tasks: 11 (limit: 28486)
     Memory: 1011.9M (peak: 1.4G)
        CPU: 34.864s
     CGroup: /system.slice/kibana.service
             └─57170 /usr/share/kibana/bin/../node/glibc-217/bin/node /usr/share/kibana/bin/../src/cli/kibana/dist
##### snipped #####

Use --no-pager to keep output non-interactive (no less pager).

Start the Kibana service.
```
$ sudo systemctl start kibana
```
Stop the Kibana service.
```
$ sudo systemctl stop kibana
```
Stopping the service makes the web UI unavailable.
Restart the Kibana service to apply configuration changes.
```
$ sudo systemctl restart kibana
```
Restarting disconnects active users and pauses access to dashboards until startup completes.
Enable the Kibana service at boot with --now for immediate start.
```
$ sudo systemctl enable --now kibana
```
The --now flag starts the service immediately in addition to enabling it at boot.
Disable the Kibana service at boot with --now for immediate stop.
```
$ sudo systemctl disable --now kibana
```
Disable without stopping by omitting --now when a one-time outage is not desired.

Review recent Kibana logs in the systemd journal.

$ sudo journalctl --unit=kibana --since "15 minutes ago" --no-pager | rg -m 3 -n "Started Kibana|Kibana is now available|http server"
858:Jan 08 00:22:45 host kibana[57000]: [2026-01-08T00:22:45.121+00:00][DEBUG][http.server.Kibana] stopping http server
859:Jan 08 00:22:45 host kibana[57000]: [2026-01-08T00:22:45.125+00:00][DEBUG][http.server.Kibana] http server stopped
1526:Jan 08 00:22:51 host kibana[57170]: [2026-01-08T00:22:51.444+00:00][DEBUG][http.server.Preboot] starting http server

Follow Kibana logs in real time, exiting with Ctrl+C.
```
$ sudo journalctl --unit=kibana --follow
```

Confirm the Kibana process is listening on TCP port 5601.

$ sudo ss --listening --tcp --numeric --processes | grep ':5601'
LISTEN 0      511               0.0.0.0:5601       0.0.0.0:*    users:(("node",pid=57170,fd=22))

The listening port can differ when server.port is changed in /etc/kibana/kibana.yml.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.