# Analytics and clickthrough not available due to permission issues

**URL:** <https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904>\
**Category:** Elastic Search\
**Created:** [September 10, 2021, 4:22pm UTC](https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904 "2021-09-10T16:22:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![reka.gay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reka.gay/32/91470_2.png) [@reka.gay](https://discuss.elastic.co/u/reka.gay)\
**Post date:** [September 10, 2021, 4:22pm UTC](https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904/1 "2021-09-10T16:22:21Z")

</div>

I have `enterprise-search` running as a service - which means that I have changed ownership of its logs to the `enterprise-search` user (otherwise it crashes on startup)

For some reason however, it doesn't show any query statistics, API logs or click-throughs. If I stop the service and start it manually as sudo, then all is fine so I'm guessing this is some sort of permission issue.

Which user should the logs belong to?

---

<div class="post-metadata">

**Author:** ![ross.bell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ross.bell/32/77559_2.png) [@ross.bell](https://discuss.elastic.co/u/ross.bell)\
**Post date:** [September 10, 2021, 5:15pm UTC](https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904/2 "2021-09-10T17:15:13Z")

</div>

Hey @reka.gay,

Do you see any errors in the application logs? Especially around startup, searching, or viewing the analytics UI. Maybe take a peak at the Elasticsearch logs too just in case there exists a running user permissions issue there too.

Without knowing much more, my best guess would be that some log files have incorrect permissions, especially because you observe it working correctly when run with _sudo_. If nothing else, I'd recommend a fresh install, taking care to start Enterprise Search for the first time with the correct `enterprise-search` system user.

I hope that helps.

Ross

---

<div class="post-metadata">

**Author:** ![reka.gay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reka.gay/32/91470_2.png) [@reka.gay](https://discuss.elastic.co/u/reka.gay)\
**Post date:** [September 13, 2021, 3:44am UTC](https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904/3 "2021-09-13T03:44:35Z")

</div>

Hi @ross.bell , thanks for the response. I can't see any errors in either of the logs. However, looking at the `filebeat` log, it seems it's only running when I start enterprise search as sudo. No errors here, either.

---

<div class="post-metadata">

**Author:** ![ross.bell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ross.bell/32/77559_2.png) [@ross.bell](https://discuss.elastic.co/u/ross.bell)\
**Post date:** [September 14, 2021, 5:06pm UTC](https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904/4 "2021-09-14T17:06:58Z")

</div>

I would avoid running your Enterprise Search deploy as any user other than the `enterprise-search` user you reference. It sounds like your deploy may be in a state where it does not have appropriate permissions to the files it needs, and the easiest resolution would be to install a fresh instance.

---

<div class="post-metadata">

**Author:** ![reka.gay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reka.gay/32/91470_2.png) [@reka.gay](https://discuss.elastic.co/u/reka.gay)\
**Post date:** [September 16, 2021, 11:03am UTC](https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904/5 "2021-09-16T11:03:15Z")

</div>

It is being deployed and run with the `enterprise-search` user. All deployment instructions are being followed. If I were to redeploy, I would just arrive to the same conclusion.

In fact, I have redeployed but my second server behaves the same.

I suspect this is because the [original deployment instructions](https://www.elastic.co/downloads/enterprise-search) only take you as far as starting up the process using

```auto
ENT_SEARCH_DEFAULT_PASSWORD=[default_pwd] /usr/share/enterprise-search/bin/enterprise-search

```

But not as a service. If started as a service, it doesn't have access to its logs, so I changed the owners of all enterprise-search log files to be the `enterprise-search` user. Could this have caused the issue? Or could it be that i have in fact started the process for the first time using `sudo` (which would be very odd)

---

<div class="post-metadata">

**Author:** ![reka.gay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/reka.gay/32/91470_2.png) [@reka.gay](https://discuss.elastic.co/u/reka.gay)\
**Post date:** [September 23, 2021, 11:01am UTC](https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904/6 "2021-09-23T11:01:40Z")

</div>

In the end, I did re-install it and tried to follow the installation instructions as-is - without using `sudo` to try and start the process for the first time. As can be seen in the post above.

However, this doesn't work: the process will not have access to its configuration file, running as the local user. Running as `sudo -u enterprise-search` doesn't work either. In the end, I had to change the owner of

- `/usr/share/enterprise-search/tmp`
- `/usr/share/enterprise-search/filebeat/data`

to `enterprise-search` - which has finally resolved the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:32am UTC](https://discuss.elastic.co/t/analytics-and-clickthrough-not-available-due-to-permission-issues/283904/7 "2022-11-04T08:32:15Z")

</div>


