(I'm not sure if this problem is a bug or if it's just because it's work in progress.)

In brief:

I upgraded kibana from elasticsearch-5.0.0-alpha4.rpm and started kibana by typing service kibana restart.

This ends up creating two logs files directly under root: /undefined.stderr and /undefined.stdout

In depth:

This is most likely caused by this line in /etc/init.d/kibana:

  chroot --userspec "$user":"$group" "$chroot" sh -c "

    cd \"$chdir\"
    exec \"$program\" $args
  " >> undefined.stdout 2>> undefined.stderr &

The last part shows undefined.stdout and undefined.stderr are written to the current directory, which service is apparently setting to root. (If I call /etc/init.d/kibana start directly, the files are created in the directory in which I typed the command.)