How to manage the Kibana service with systemctl in Linux

Managing the Kibana service with systemd lets an operator start the web UI, take it offline for maintenance, apply configuration changes, and control whether it returns after a reboot. Package-based Linux installs expose this control through the kibana.service unit.

DEB and RPM packages install a systemd unit that runs as the kibana user, uses KBN_PATH_CONF=/etc/kibana, accepts optional environment files from /etc/default/kibana and /etc/sysconfig/kibana, and writes standard output to the journal. Those package defaults make systemctl and journalctl the normal service-control tools for self-managed hosts.

An active (running) service state proves that the Kibana process started, not that every dashboard and API route is ready for users. Fresh secured installs can still wait at the enrollment or interactiveSetup stage until Elasticsearch connection settings are valid, so pair service checks with the Kibana status API when application readiness matters.

1. Check the current Kibana service state.

   $ sudo systemctl status kibana.service --no-pager
   ● kibana.service - Kibana
        Loaded: loaded (/usr/lib/systemd/system/kibana.service; enabled; preset: enabled)
        Active: active (running) since Thu 2026-06-18 14:22:09 UTC; 18s ago
          Docs: https://www.elastic.co
      Main PID: 8123 (node)
         Tasks: 11 (limit: 28672)
        Memory: 642.4M (peak: 650.1M)
           CPU: 9.481s
        CGroup: /system.slice/kibana.service
                └─8123 /usr/share/kibana/node/bin/node /usr/share/kibana/src/cli/dist
   ##### snipped #####

   The Loaded line shows both the unit file path and boot-start state. disabled; preset: enabled means the vendor preset allows boot start, but the local host has not enabled it yet.

2. Reload the systemd manager after installing the package or changing a unit override.

   $ sudo systemctl daemon-reload

   No output indicates systemd accepted the manager reload.

3. Start the Kibana service.

   $ sudo systemctl start kibana.service

   The command normally prints no success output. Password-protected Kibana keystores need KBN_KEYSTORE_PASSPHRASE_FILE or KEYSTORE_PASSWORD in the service environment before non-interactive service starts.
   Related: How to create a Kibana keystore

4. Confirm that Kibana is running.

   $ systemctl is-active kibana.service
   active

   Use the full status output or the journal when this command returns failed, activating, or inactive instead of active.

5. Enable Kibana to start automatically at boot.

   $ sudo systemctl enable kibana.service
   Created symlink /etc/systemd/system/multi-user.target.wants/kibana.service -> /usr/lib/systemd/system/kibana.service.

6. Confirm the boot-start state.

   $ systemctl is-enabled kibana.service
   enabled

7. Restart Kibana after changing its configuration, keystore-backed settings, or service environment.

   $ sudo systemctl restart kibana.service

   Restart after edits to /etc/kibana/kibana.yml, secure settings loaded from the keystore, or package environment files. Run daemon-reload first when a unit override under /etc/systemd/system/kibana.service.d/ changed.
   Related: How to set the Kibana server host
   Related: How to connect Kibana to Elasticsearch

8. Review recent Kibana service logs in the journal.

   $ sudo journalctl --unit=kibana.service --since "10 minutes ago" --no-pager
   Jun 18 14:22:09 kibana-01 systemd[1]: Started kibana.service - Kibana.
   Jun 18 14:22:12 kibana-01 kibana[8123]: [2026-06-18T14:22:12.412+00:00][INFO ][root] Kibana is starting
   Jun 18 14:22:17 kibana-01 kibana[8123]: [2026-06-18T14:22:17.803+00:00][INFO ][http.server.Preboot] http server running at http://localhost:5601
   Jun 18 14:22:17 kibana-01 kibana[8123]: [2026-06-18T14:22:17.851+00:00][INFO ][preboot] "interactiveSetup" plugin is holding setup: Validating Elasticsearch connection configuration
   ##### snipped #####

   Package defaults send Kibana standard output to the systemd journal. Use the unfiltered journal when startup loops, enrollment prompts, or plugin errors need review.
   Related: How to set Kibana logging levels

9. Stop Kibana when the web UI and APIs should be offline.

   $ sudo systemctl stop kibana.service

   Stopping the service makes Kibana unavailable until it is started again or the host reaches a boot target where the service is enabled.

10. Confirm that the service stopped.

    $ systemctl is-active kibana.service
    inactive

11. Disable automatic startup when Kibana should remain manual after reboot.

    $ sudo systemctl disable kibana.service
    Removed "/etc/systemd/system/multi-user.target.wants/kibana.service".

    Use sudo systemctl disable --now kibana.service only when the service should be disabled and stopped in one operation.