# Exiting: error loading config file: open filebeat.yml: permission denied

**URL:** <https://discuss.elastic.co/t/exiting-error-loading-config-file-open-filebeat-yml-permission-denied/239490>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 1, 2020, 12:51pm UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-open-filebeat-yml-permission-denied/239490 "2020-07-01T12:51:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mschindl](https://avatars.discourse-cdn.com/v4/letter/m/6a8cbe/32.png) [@mschindl](https://discuss.elastic.co/u/mschindl)\
**Post date:** [July 1, 2020, 12:51pm UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-open-filebeat-yml-permission-denied/239490/1 "2020-07-01T12:51:36Z")

</div>

I try to specifiy the config file for filebeat, but all the time I get a permission denied error in the container. User root is set and strict.perms=false too.

I'm using following versions:

[root@mschindl-lnx1 config-dir]# docker version

> Client:  
> Version: 1.13.1  
> API version: 1.26  
> Package version: docker-1.13.1-161.git64e9980.el7\_8.x86\_64  
> Go version: go1.10.3  
> Git commit: 64e9980/1.13.1  
> Built: Tue Apr 28 14:43:01 2020  
> OS/Arch: linux/amd64
> 
> Server:  
> Version: 1.13.1  
> API version: 1.26 (minimum version 1.12)  
> Package version: docker-1.13.1-161.git64e9980.el7\_8.x86\_64  
> Go version: go1.10.3  
> Git commit: 64e9980/1.13.1  
> Built: Tue Apr 28 14:43:01 2020  
> OS/Arch: linux/amd64  
> Experimental: false

[root@mschindl-lnx1 config-dir]# cat /etc/redhat-release

> CentOS Linux release 7.8.2003 (Core)

[root@mschindl-lnx1 config-dir]# docker run -d   
\> -h filebeat   
\> -u root   
\> --name filebeat   
\> -v /mnt/auditlogs/:/mnt/audit/   
\> --volume="/config-dir/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"   
\> --volume="/var/lib/docker/containers:/var/lib/docker/containers:ro"   
\> --volume="/var/run/docker.sock:/var/run/docker.sock:ro"   
\> [docker.elastic.co/beats/filebeat:7.8.0](http://docker.elastic.co/beats/filebeat:7.8.0) filebeat -e -strict.perms=false   
\> -E output.elasticsearch.hosts=["elasticsearch:9200"]  
cee692103573ad316b9a60ab082f0d6d227a146be24f5a4ce23e121236b80232

[root@mschindl-lnx1 config-dir]# docker logs filebeat

> Exiting: error loading config file: open filebeat.yml: permission denied

[root@mschindl-lnx1 config-dir]# ls -lisah filebeat.yml

> 69806038 4.0K -rw-r--r--. 1 root root 359 Jul 1 14:39 filebeat.yml

**Workaround** in a another thread didn't work:

[root@mschindl-lnx1 config-dir]# docker exec -it filebeat bash -l  
[root\*\*@filebeat\*\* filebeat]# ls -lnR /usr/share/filebeat/filebeat.yml

> -rw-r-----. 1 0 1000 319 Jun 14 18:19 /usr/share/filebeat/filebeat.yml

[root\*\*@mschindl-lnx\*\*1 config-dir]# ls -n filebeat.yml

> -rw-r-----. 1 0 1000 359 Jul 1 14:39 filebeat.yml

Any help is appreciated 🙂

(I want to use filebeat to filter an audit.log file for a specific error code and sent it to elasticsearch.)

---

<div class="post-metadata">

**Author:** ![mschindl](https://avatars.discourse-cdn.com/v4/letter/m/6a8cbe/32.png) [@mschindl](https://discuss.elastic.co/u/mschindl)\
**Post date:** [July 2, 2020, 1:17pm UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-open-filebeat-yml-permission-denied/239490/2 "2020-07-02T13:17:42Z")

</div>

The issue was selinux. For testing I disabled it now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2020, 3:17pm UTC](https://discuss.elastic.co/t/exiting-error-loading-config-file-open-filebeat-yml-permission-denied/239490/3 "2020-07-30T15:17:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.