Command line works, service does not

[Frizz_Supertramp]

I have a very simple config that should produce tons of output:

input {
  file {
    path => "/var/log/glusterfs/*.log"
    start_position => "beginning"
    sincedb_path => "/dev/null"
  }
}
output {
	stdout { codec => rubydebug }
}

When running from command line it does, when running as a service it does not.

I've enabled debugging in the conf file, but all I get is this:

[2017-10-05T17:03:17,276][DEBUG][logstash.pipeline        ] Pushing flush onto pipeline
[2017-10-05T17:03:21,386][DEBUG][logstash.inputs.file     ] _globbed_files: /var/log/glusterfs/*.log: glob is: ["/var/log/glusterfs/glustershd.log", "/var/log/glusterfs/test.log", "/var/log/glusterfs/cli.log", "/var/log/glusterfs/glusterd.log", "/var/log/glusterfs/events.log", "/var/log/glusterfs/cmd_history.log"]
[2017-10-05T17:03:22,276][DEBUG][logstash.pipeline        ] Pushing flush onto pipeline
[2017-10-05T17:03:27,275][DEBUG][logstash.pipeline        ] Pushing flush onto pipeline

But no output to stdout (same for file or gelf or any other output).

Edit: I narrowed it down a little bit more: When running this line

/usr/share/logstash/bin/logstash -f glusterfs.conf --path.settings etc/logstash

.... as root it works. When running the same line as user logstash it does not work. I have set "log.level: trace" in logstash.yml, but no errors or warnings show in the logfile.

[magnusbaeck (Magnus Bäck)]

Does the logstash user have read access to the log files?

[Frizz_Supertramp]

Yes. Out of desperation I even changed it to 777 - still not working.

I'd be happy if Logstash would give me a hint why it's not working

What can I do to get more information (log.level is already at "trace")?

[Edit] What I don't understand is why the files are not discovered. I mean I see lines like this:

_globbed_files: /var/log/glusterfs/*.log: glob is: ["/var/log/glusterfs/glustershd.log", "...

But no lines like this:

_discover_file: /var/log/glusterfs/*.log: new: /var/log/glusterfs/glustershd.log
_discover_file: /var/log/glusterfs/*.log: new: /var/log/glusterfs/cli.log

[jakelandis]

When using stdout with a service, you will need to find where the stdout gets logged. For example for systemD based Linux distro's you can find it via journalctl.

journalctl -r -u logstash

or to tail it:

journalctl -f -u logstash

[Frizz_Supertramp]

I am not using a service with stdout. I run logstash from a command line (at least for testing). One time as user root (working), one time as user logstash (not working)