Hi,
I created a pipeline that outputs the content into home folder of one of the users. When i run the pipeline manually as root, there is no issue, but then i try to do the same using pipelines.yml and logstash service, it generates an error.
User name: audit
ls -l /home/
total 4
drwx------. 4 audit audit 92 Nov 27 08:28 audit
I created a folder within /home/audit and changed owner to logstash
ls -l /home/audit/
total 0
drwxr-xr-x. 2 logstash logstash 6 Nov 27 10:12 winlog
When i run the pipeline using logstash service i got:
[2019-11-27T10:15:23,046][INFO ][logstash.outputs.file ][file_output_pipeline] Opening file {:path=>"/home/audit/winlog/logs/2019_11/2019_11_26.txt"}
[2019-11-27T10:15:23,068][INFO ][logstash.outputs.file ][file_output_pipeline] Creating directory {:directory=>"/home/audit/winlog/logs/2019_11"}
[2019-11-27T10:15:23,195][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id=>"file_output_pipeline", :thread=>"#<Thread:0x5d316a0b@/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:37 run>"}
[2019-11-27T10:15:23,251][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<Errno::EACCES: Permission denied - /home/audit/winlog>, :backtrace=>["org/jruby/RubyDir.java:590:in `mkdir'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/fileutils.rb:235:in `fu_mkdir'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/fileutils.rb:213:in `block in mkdir_p'", "org/jruby/RubyArray.java:1882:in `reverse_each'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/fileutils.rb:211:in `block in mkdir_p'", "org/jruby/RubyArray.java:1800:in `each'", "uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/fileutils.rb:196:in `mkdir_p'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-file-4.2.6/lib/logstash/outputs/file.rb:273:in `open'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-file-4.2.6/lib/logstash/outputs/file.rb:136:in `block in multi_receive_encoded'", "org/jruby/RubyHash.java:1417:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-file-4.2.6/lib/logstash/outputs/file.rb:135:in `block in multi_receive_encoded'", "org/jruby/ext/thread/Mutex.java:160:in `synchronize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-file-4.2.6/lib/logstash/outputs/file.rb:134:in `multi_receive_encoded'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:87:in `multi_receive'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:118:in `multi_receive'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:101:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:394:in `block in output_batch'", "org/jruby/RubyHash.java:1417:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:393:in `output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:345:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:308:in `block in start_workers'"]}
[2019-11-27T10:15:23,554][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit