Logs in the file "message"

Enterprise Support
1

**Hi all,

ROR Version**: 1.68.0_es8.18.8 :unicorn:

Kibana Version: 8.18.8

Elasticsearch Version:8.18.3

Steps to reproduce the issue
kibana.yml

logging:
  appenders:
    rolling-file:
      type: rolling-file
      fileName: /var/log/kibana/kibana.log
      policy:
        type: time-interval
        interval: 24h
        modulate: true
      strategy:
        type: numeric
        pattern: '-%i'
        max: 7
      layout:
        type: json
  loggers:
    - name: root
      appenders: [rolling-file]

**

tail -f /var/log/message**

Expected result:
Kibana logs should be in the kibana logs file.
example
/var/log/kibana/kibana.log

Actual Result:
A lot of logs are written in /var/log/message
all logs

wc -l /var/log/messages
5478600 /var/log/messages

Ror logs

grep -c ReadonlyREST /var/log/messages
5465178

99.75% of logs are plugin logs.

Example logs

count 2738340

2026-01-26T10:20:40.547599+00:00 host INFO kibana[1985178]: [2026-01-26T10:20:40.546+00:00][warning][plugins][ReadonlyREST][esIndexClient][x-ror-correlation-id=6b3b2bf5-c3f7-4f12-a4ff-f19146e88ba2] Could not find a valid session in index for SID _delete_by_query (probably the cookiePass or internal format changed?)

count 2743904

2026-01-25T00:00:39.967008+00:00 host INFO kibana[789549]: [2026-01-25T00:00:39.966+00:00][warning][plugins][ReadonlyREST][esIndexClient][x-ror-correlation-id=4415b5c4-9c7b-48e1-bd8d-f245f12620e9] encryptedIdentitySessionHeaders not available, but there is a session '{"expiresAt":1769356083918,"lastSessionActivityDate":1769096883918,"encryptedAuthorizationHeaders":".....","username":"user","availableGroups":[],"kibanaHiddenApps":["Elasticsearch","Machine Learning","Stack Management","Management","Observability","ROR Manage Kibana"],"kibanaAccess":"rw","kibanaIndex":".kibana","correlationId":"59341465-395d-4690-ba64-b4d1db74927b"}'

The remaining plugin logs are only 142 count.

This is a log for 2 days.

please help me
How do I disable or redirect these logs in /var/log/kibana/kibana.log?
Or how do I solve this warning?

{“customer_id”: “6c4a385b-2ae8-4f02-a9cd-ef24addfb5b3”, “subscription_id”: “32d4073f-dc2f-4056-a868-842727c637cd”}

2

Hello @driveirk

Thanks for pointing it out. Currently, the Readonlyrest Kibana plugin doesn’t support rolling-file logging type, which is why logs strictly from the plugin are not saved in the file. We currently have a task for supporting it. I will bump the priority. We support two types of logging, fileand console. Since only rotated files will receive a suffix, it looks like these settings should work in your case

logging:
    appenders:
        readonlyrest-file:
            type: file
            fileName: /var/log/kibana/kibana.log
            layout:
                type: json
        rolling-file:
            type: rolling-file
            fileName: /var/log/kibana/kibana.log
            policy:
                type: time-interval
                interval: 24h
                modulate: true
            strategy:
                type: numeric
                pattern: '-%i'
                max: 7
            layout:
                type: json
    root:
        level: info
        appenders: [readonlyrest-file, rolling-file]
3

Hi @Dzuming

Thanks for you help.
I have specified a new config, I will monitor the status.

4

Yes, your solution helped, thank you. Please let me know when you fix the rolling-file bug.

1 Like