# Error=\>logstash Pipeline worker error :"(EACCES) Permission denied

**URL:** <https://discuss.elastic.co/t/error-logstash-pipeline-worker-error-eacces-permission-denied/324788>\
**Category:** Logstash\
**Created:** [February 6, 2023, 11:29am UTC](https://discuss.elastic.co/t/error-logstash-pipeline-worker-error-eacces-permission-denied/324788 "2023-02-06T11:29:20Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vaibhav.ubale](https://avatars.discourse-cdn.com/v4/letter/v/e9a140/32.png) [@vaibhav.ubale](https://discuss.elastic.co/u/vaibhav.ubale)\
**Post date:** [February 6, 2023, 11:29am UTC](https://discuss.elastic.co/t/error-logstash-pipeline-worker-error-eacces-permission-denied/324788/1 "2023-02-06T11:29:20Z")

</div>

Hi Team/Everyone,

I am facing a pipeline error and my pipeline is terminating randomly with error=\>"(EACCES) Permission denied - /var/myrepo/devops/mytask\_watcher.csv"

My logstash output conf is as below

```auto
output {

csv {
      fields => ["message"]
      path => "/var/repository/devops/mytask_watcher.csv"
   }
}

```

and Operating System:  
NAME="CentOS Linux"  
VERSION="7 (Core)"

Folder Permission  
10:51:45 Mon Feb 06 -\>: $ ls -ltrh /var/myrepo/ |grep devops  
drwxrwxr-x 2 logstash logstash 6 Feb 6 10:50 devops

Logstash Version : logstash 7.16.2

I have added logstash to sudoers group as well but still unable to resolve this error.

Detailed error is as follows:

```auto
[2023-02-02T12:55:02,625][ERROR][logstash.javapipeline][watcher-mytask] Pipeline worker error, the pipeline will be stopped {:pipeline_id=>"watcher-mytask", :error=>"(EACCES) Permission denied - /var/myrepo/devops/mytask_watcher.csv", :exception=>Java::OrgJrubyExceptions::SystemCallError, :backtrace=>["org.jruby.RubyIO.sysopen(org/jruby/RubyIO.java:1237)", "org.jruby.RubyFile.initialize(org/jruby/RubyFile.java:365)", "org.jruby.RubyIO.new(org/jruby/RubyIO.java:876)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_file_minus_4_dot_3_dot_0.lib.logstash.outputs.file.open(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-file-4.3.0/lib/logstash/outputs/file.rb:276)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_csv_minus_3_dot_0_dot_8.lib.logstash.outputs.csv.multi_receive_encoded(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-csv-3.0.8/lib/logstash/outputs/csv.rb:46)", "org.jruby.RubyHash.each(org/jruby/RubyHash.java:1415)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_csv_minus_3_dot_0_dot_8.lib.logstash.outputs.csv.multi_receive_encoded(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-csv-3.0.8/lib/logstash/outputs/csv.rb:45)", "org.jruby.ext.thread.Mutex.synchronize(org/jruby/ext/thread/Mutex.java:164)", "usr.share.logstash.vendor.bundle.jruby.$2_dot_5_dot_0.gems.logstash_minus_output_minus_csv_minus_3_dot_0_dot_8.lib.logstash.outputs.csv.multi_receive_encoded(/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-csv-3.0.8/lib/logstash/outputs/csv.rb:44)", "usr.share.logstash.logstash_minus_core.lib.logstash.outputs.base.multi_receive(/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:103)", "org.logstash.config.ir.compiler.OutputStrategyExt$AbstractOutputStrategyExt.multi_receive(org/logstash/config/ir/compiler/OutputStrategyExt.java:143)", "org.logstash.config.ir.compiler.AbstractOutputDelegatorExt.multi_receive(org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:121)", "usr.share.logstash.logstash_minus_core.lib.logstash.java_pipeline.start_workers(/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:299)"], :thread=>"#<Thread:0x7b3fd5df@/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:54 sleep>"}
[2023-02-02T12:55:03,535][INFO][logstash.javapipeline][watcher-mytask] Pipeline terminated {"pipeline.id"=>"watcher-mytask"}

```

Can some one help me over here or atleast point in right direction.  
Thanks

PS: I have other two pipelines with same output path for csv in same folder which are not having any such problem.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [February 6, 2023, 6:48pm UTC](https://discuss.elastic.co/t/error-logstash-pipeline-worker-error-eacces-permission-denied/324788/2 "2023-02-06T18:48:01Z")

</div>

Have you checked permissions for /var/myrepo/devops/mytask\_watcher.csv?  
Should be set for logstash user, maybe you should change ownership for mytask\_watcher.csv.

---

<div class="post-metadata">

**Author:** ![vaibhav.ubale](https://avatars.discourse-cdn.com/v4/letter/v/e9a140/32.png) [@vaibhav.ubale](https://discuss.elastic.co/u/vaibhav.ubale)\
**Post date:** [February 7, 2023, 6:26am UTC](https://discuss.elastic.co/t/error-logstash-pipeline-worker-error-eacces-permission-denied/324788/3 "2023-02-07T06:26:23Z")

</div>

Hi Rios,

Thanks for your reply

The file is having the permission as below when ever it is created by logstash.

```auto
 06:17:15 Tue Feb 07 ->: $ ls -ltr /var/myrepo/devops/
total 4
-rw-r--r-- 1 logstash logstash 273 Feb 7 06:18 mytask_watcher.csv

```

but I can see the following logs in logstash-plain.log

```auto
[2023-02-07T06:15:01,090][INFO][logstash.outputs.csv][watcher-mytask][516cd5c0ac218c746620a3a46c4b8c92b6fd85856b5fa2445be8b5a461441419] Opening file {:path=>"/var/myrepo/devops/mytask_watcher.csv"}
[2023-02-07T06:15:28,563][INFO][logstash.outputs.csv][watcher-mytask][516cd5c0ac218c746620a3a46c4b8c92b6fd85856b5fa2445be8b5a461441419] Closing file /var/myrepo/devops/mytask_watcher.csv

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2023, 6:26am UTC](https://discuss.elastic.co/t/error-logstash-pipeline-worker-error-eacces-permission-denied/324788/4 "2023-03-07T06:26:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
