# Logstash as service not reading log files

**URL:** <https://discuss.elastic.co/t/logstash-as-service-not-reading-log-files/363774>\
**Category:** Logstash\
**Created:** [July 25, 2024, 9:54am UTC](https://discuss.elastic.co/t/logstash-as-service-not-reading-log-files/363774 "2024-07-25T09:54:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Glen\_Elkins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/glen_elkins/32/136303_2.png) [@Glen\_Elkins](https://discuss.elastic.co/u/Glen_Elkins)\
**Post date:** [July 25, 2024, 9:54am UTC](https://discuss.elastic.co/t/logstash-as-service-not-reading-log-files/363774/1 "2024-07-25T09:54:49Z")

</div>

I am running logstash as a service by modifying /etc/systemd/system/logstash.service with:

`ExecStart=/usr/share/logstash/bin/logstash -f /usr/share/logstash/config/logstash.conf --config.reload.automatic`

Nothing is being read from the log /var/log/audit/audit.log

But, if i run the same command myself in terminal:

`sudo /usr/share/logstash/bin/logstash -f /usr/share/logstash/config/logstash.conf --config.reload.automatic`

It works fine? This is not ideal, i need it running as a service with my custom config file.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [July 25, 2024, 10:14am UTC](https://discuss.elastic.co/t/logstash-as-service-not-reading-log-files/363774/2 "2024-07-25T10:14:50Z")

</div>

In your case, LS as a service is run under _logstash_ user which in the most cases means doesn't have right to read /var/log/audit/audit.log

When you run as a command, it will run as root user. So for that particular case you can, start LS service as root or try to use Auditbeat

---

<div class="post-metadata">

**Author:** ![Glen\_Elkins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/glen_elkins/32/136303_2.png) [@Glen\_Elkins](https://discuss.elastic.co/u/Glen_Elkins)\
**Post date:** [July 25, 2024, 11:21am UTC](https://discuss.elastic.co/t/logstash-as-service-not-reading-log-files/363774/3 "2024-07-25T11:21:13Z")

</div>

Oh I’m so dumb, I literally just noticed it sets the user to logstash in the config.

Thanks for the fast response. That actually would help with other logs it reads where I change the owner to logstash instead of root