Filebeat 6.2.4 running as root on Red Hat Linux

Elastic Stack Beats
1

Hi.

Somehow Filebat insists on running as root, and not as filebeat user.
Should not Filebeat run as the filebeat user?

My setup:
Linux: Red Hat Enterprise Linux Server release 6.9
Java: openjdk version "1.8.0_161"
Filebeat version: filebeat-6.2.4-x86_64.rpm

How I installed Filebeat:
sudo rpm -ivh filebeat-6.2.4-x86_64.rpm

How I start Filebat:
sudo service filebeat start

2

By default, we start Filebeat as the root user to be able to read all the logs generated by all application, but nothing prevents you from editing the startup scripts to make FB run as another user. You need to make sure the users/group have the right privileges to read and stat them.

related post with a few tricks: Filebeat as a non-root user

3

With RHEL 6 you will be using SysV to start Filebeat. The init.d script sources /etc/sysconfig/filebeat if it exists so that you can set BEAT_USER in order to override the default value of root.

# File: /etc/sysconfig/filebeat
BEAT_USER=my_custom_user

Then you must chown -R the config files under /etc/filebeat to ensure that Filebeat starts. Filebeat checks ownership and permissions.

I'd test filebeat as your custom user too.

sudo su - my_custom_user
filebeat test config -e
4

Thanks andrewkroh, I can test it today.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.