How to manage the Kibana service with systemctl in Linux

Managing the Kibana service controls access to dashboards and APIs during upgrades, maintenance windows, and recovery after failures. Quick start/stop/restart operations reduce downtime and help keep the web UI responsive when changes are applied.

On most Linux systems, Kibana is installed as a systemd unit named kibana.service. The systemctl command manages the service lifecycle, while journalctl shows startup progress and runtime errors captured by the system journal.

Service restarts interrupt active sessions and may temporarily show Kibana server is not ready yet while plugins initialize and the connection to Elasticsearch is established. Configuration is commonly stored in /etc/kibana/kibana.yml, and changes to settings like server.host or server.port require a restart to take effect.

Steps to manage the Kibana service with systemctl in Linux:

Check the Kibana service status.

$ sudo systemctl status kibana --no-pager --full
● kibana.service - Kibana
     Loaded: loaded (/lib/systemd/system/kibana.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2026-01-05 09:12:38 UTC; 2min 14s ago
       Docs: https://www.elastic.co
   Main PID: 1458 (node)
      Tasks: 11 (limit: 18990)
     Memory: 318.4M
        CPU: 7.432s
     CGroup: /system.slice/kibana.service
             └─1458 /usr/share/kibana/node/bin/node /usr/share/kibana/src/cli/dist
##### snipped #####

Use --no-pager to keep output non-interactive (no less pager).

Start the Kibana service.
```
$ sudo systemctl start kibana
```
Stop the Kibana service.
```
$ sudo systemctl stop kibana
```
Stopping the service makes the web UI unavailable.
Restart the Kibana service to apply configuration changes.
```
$ sudo systemctl restart kibana
```
Restarting disconnects active users and pauses access to dashboards until startup completes.

Enable the Kibana service at boot with --now for immediate start.

$ sudo systemctl enable --now kibana
Created symlink /etc/systemd/system/multi-user.target.wants/kibana.service -> /lib/systemd/system/kibana.service.

The --now flag starts the service immediately in addition to enabling it at boot.

Disable the Kibana service at boot with --now for immediate stop.
```
$ sudo systemctl disable --now kibana
Removed "/etc/systemd/system/multi-user.target.wants/kibana.service".
```
Disable without stopping by omitting --now when a one-time outage is not desired.

Review recent Kibana logs in the systemd journal.

$ sudo journalctl --unit=kibana --since "15 minutes ago" --no-pager
Jan 05 09:12:32 server systemd[1]: Starting Kibana...
Jan 05 09:12:38 server systemd[1]: Started Kibana.
Jan 05 09:12:45 server kibana[1458]: [info][http.server] http server running at http://0.0.0.0:5601
Jan 05 09:12:52 server kibana[1458]: [info][plugins-system] Setting up plugins
##### snipped #####

Follow Kibana logs in real time, exiting with Ctrl+C.

$ sudo journalctl --unit=kibana --follow
Jan 05 09:15:04 server kibana[1458]: [info][plugins-system] Starting plugin: alerting
Jan 05 09:15:09 server kibana[1458]: [info][status] Kibana is now available

Confirm the Kibana process is listening on TCP port 5601.

$ sudo ss --listening --tcp --numeric --processes | grep ':5601'
LISTEN 0      511          0.0.0.0:5601        0.0.0.0:*    users:(("node",pid=1458,fd=41))

The listening port can differ when server.port is changed in /etc/kibana/kibana.yml.

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.