# Logstash(5.4.3) fails to transfer logs even when logstash starts as a service

**URL:** <https://discuss.elastic.co/t/logstash-5-4-3-fails-to-transfer-logs-even-when-logstash-starts-as-a-service/130093>\
**Category:** Logstash\
**Created:** [May 1, 2018, 7:13am UTC](https://discuss.elastic.co/t/logstash-5-4-3-fails-to-transfer-logs-even-when-logstash-starts-as-a-service/130093 "2018-05-01T07:13:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nikhil.k](https://avatars.discourse-cdn.com/v4/letter/n/5daacb/32.png) [@nikhil.k](https://discuss.elastic.co/u/nikhil.k)\
**Post date:** [May 1, 2018, 7:13am UTC](https://discuss.elastic.co/t/logstash-5-4-3-fails-to-transfer-logs-even-when-logstash-starts-as-a-service/130093/1 "2018-05-01T07:13:06Z")

</div>

Hi Everyone,

In my scenario, I installed logstash using yum. The logstash version is 5.4.3. I am sending /var/log/messages to a file(output.txt) which is present on same system.  
Operating System - Centos

Below is the logstash.conf file which is present in the path (/etc/logstash/conf.d/logstash.conf)  
input {  
file {  
path =\> "/var/log/messages"  
start\_position =\> "beginning"  
ignore\_older =\> 0  
}  
}  
output {  
file {  
path =\> "/root/output.txt"  
}  
}

When I am starting logstash as a service using command #systemctl restart logstash.service, the service gets started but logs are not transferred to output.txt file.  
Opening the (/var/log/logstash/logstash-plain.log), i found that it says "permission error"

[2018-05-01T11:59:13,922][WARN][logstash.runner] SIGTERM received. Shutting down the agent.  
[2018-05-01T11:59:13,928][WARN][logstash.agent] stopping pipeline {:id=\>"main"}  
[2018-05-01T11:59:44,665][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>1, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>125}  
[2018-05-01T11:59:44,916][WARN][logstash.inputs.file] failed to open /var/log/messages: Permission denied - /var/log/messages  
[2018-05-01T11:59:44,944][INFO][logstash.pipeline] Pipeline main started  
[2018-05-01T11:59:45,013][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2018-05-01T12:04:45,298][WARN][logstash.inputs.file] failed to open /var/log/messages: Permission denied - /var/log/messages  
[2018-05-01T12:09:46,658][WARN][logstash.inputs.file] failed to open /var/log/messages: Permission denied - /var/log/messages  
[2018-05-01T12:14:47,998][WARN][logstash.inputs.file] failed to open /var/log/messages: Permission denied - /var/log/messages

Please help me to solve this issue.

Thanks  
Nikhil Kapoor

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 1, 2018, 7:30am UTC](https://discuss.elastic.co/t/logstash-5-4-3-fails-to-transfer-logs-even-when-logstash-starts-as-a-service/130093/2 "2018-05-01T07:30:09Z")

</div>

The user that Logstash runs as ("logstash", probably) obviously doesn't have permissions to read /var/log/messages. What are the permissions of that file? For completeness, the permissions of /var and /var/log should also be considered.

---

<div class="post-metadata">

**Author:** ![nikhil.k](https://avatars.discourse-cdn.com/v4/letter/n/5daacb/32.png) [@nikhil.k](https://discuss.elastic.co/u/nikhil.k)\
**Post date:** [May 1, 2018, 7:41am UTC](https://discuss.elastic.co/t/logstash-5-4-3-fails-to-transfer-logs-even-when-logstash-starts-as-a-service/130093/3 "2018-05-01T07:41:40Z")

</div>

Thanks for the reply @magnusbaeck

Changed few things in the /etc/systemd/system/logstash.service file  
User=logstash  
Group=logstash

to

User=root  
Group=root

Use the command #systemctl daemon-reload and then restarted the logstash service.  
It worked.

> What are the permissions of that file?  
> -rw-------. 1 root root 161545 May 1 13:04 messages

Thanks  
Nikhil Kapoor

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 29, 2018, 7:41am UTC](https://discuss.elastic.co/t/logstash-5-4-3-fails-to-transfer-logs-even-when-logstash-starts-as-a-service/130093/4 "2018-05-29T07:41:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.