# Filebeat/module nginx ; problem with permissions **URL:** \ **Category:** Beats\ **Created:** [March 30, 2017, 9:54am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647 "2017-03-30T09:54:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Gounlaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gounlaf/32/7308_2.png) [@Gounlaf](https://discuss.elastic.co/u/Gounlaf)\ **Post date:** [March 30, 2017, 9:54am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647/1 "2017-03-30T09:54:28Z")
Hi, I updated filebeat to version 5.3.0 on a linux server (Ubuntu 16.04 LTS). I wanted to enable the module nginx; but I got an this error (when executing filebeat as a service). > 2017-03-30T11:41:38+02:00 INFO Metrics logging every 30s > 2017-03-30T11:41:38+02:00 INFO Flush Interval set to: 1s > 2017-03-30T11:41:38+02:00 INFO Max Bulk Size set to: 2048 > 2017-03-30T11:41:38+02:00 CRIT Exiting: Error reading fileset nginx/access: Error reading manifest file: config file ("/usr/share/filebeat/module/nginx/access/manifest.yml") can only be writable by the owner but the permissions are "-rw-rw-r--" (to fix the permissions use: 'chmod go-w /usr/share/filebeat/module/nginx/access/manifest.yml') Changing permissions doesn't solve the problem. I'm "noob" with ELK ; I installed version 5.2.0 first ( I was "waiting" for nginx module 🙂 before going deeper in configuration). So I uninstalled filebeat package and reinstalled it. But it doesn't work better. If I execute filebeat manually, the problem doesn't happen (I'm not sure since it's really verbose) > /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -e -d "\*" Below the filebeat.yml (condensed, comments dropped ; it seems that there is mistake in [tutorial](https://www.elastic.co/guide/en/beats/filebeat/5.3/_tutorial.html), where it's "name" key instead of "module" ) ``` filebeat.modules: - module: nginx access: enabled: true error: enabled: true filebeat.prospectors: - input_type: log paths: - /var/log/*.log output.elasticsearch: enabled: false output.logstash: enabled: true ``` If you need more informations / tests, ask me. Thanks. ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [March 30, 2017, 9:58am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647/2 "2017-03-30T09:58:51Z")
Hi @Gounlaf, Can you please share the output of running `ls -la /usr/share/filebeat/module/nginx/access/`? Also I think you are right on the tutorial, thank you for the report, I'll open an issue to fix it! ---
**Author:** ![Gounlaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gounlaf/32/7308_2.png) [@Gounlaf](https://discuss.elastic.co/u/Gounlaf)\ **Post date:** [March 30, 2017, 10:04am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647/3 "2017-03-30T10:04:40Z")
Hi @exekias, Output below (I don't have remove w permission for group ; I've done it before re-installing the package): ``` root@universe:/var/log/filebeat# ls -la /usr/share/filebeat/module/nginx/access/ total 20 drwxrwxr-x 4 root root 4096 mars 30 10:04 . drwxrwxr-x 4 root root 4096 mars 30 10:04 .. drwxrwxr-x 2 root root 4096 mars 30 10:04 config drwxrwxr-x 2 root root 4096 mars 30 10:04 ingest -rw-rw-r-- 1 root root 395 mars 23 04:09 manifest.yml ``` Edit: about the tutorial - I've encoutered another problem: It seems that the "var.paths" config key has a wrong syntax. Copy/past the one given in tutorial doesn't work and complain about "list format". But if i'm right, [the documentation about conf files](https://www.elastic.co/guide/en/beats/libbeat/5.3/config-file-format.html) "validate" the tutorial. - The path is linked to apache2, not nginx ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [March 30, 2017, 10:29am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647/4 "2017-03-30T10:29:18Z")
The file has wrong permissions. What happens if you run this and then try to launch filebeat again?: ```auto chmod go-w /usr/share/filebeat/module/nginx/access/manifest.yml ls -la /usr/share/filebeat/module/nginx/access/ ``` I've created a ticket to fix the documentation, feel free to update it with any new findings: [https://github.com/elastic/beats/issues/3857](https://github.com/elastic/beats/issues/3857) ---
**Author:** ![Gounlaf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gounlaf/32/7308_2.png) [@Gounlaf](https://discuss.elastic.co/u/Gounlaf)\ **Post date:** [March 30, 2017, 10:43am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647/5 "2017-03-30T10:43:01Z")
Oh well, my bad ; it's works. I've had to fix permission on _access_ **and** _error_ manifest. I was doing it on access manifest only ... my mistake. =\> So, yes, It works now. Btw, filebeat is installed throw apt repository. I've not compiled myself, neither downloaded a .deb manually ; and I didn't touch permissions. Thanks for the documentation ticket. ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [March 30, 2017, 10:44am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647/6 "2017-03-30T10:44:40Z")
Good you have it working, uhm I'll review that also, may be a packaging problem Thank you for reporting it! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 20, 2017, 9:54am UTC](https://discuss.elastic.co/t/filebeat-module-nginx-problem-with-permissions/80647/7 "2017-04-20T09:54:37Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.