# Logstash can't read files ( Permission denied )

**URL:** <https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728>\
**Category:** Logstash\
**Created:** [June 23, 2016, 2:47am UTC](https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728 "2016-06-23T02:47:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![kayyazka](https://avatars.discourse-cdn.com/v4/letter/k/a698b9/32.png) [@kayyazka](https://discuss.elastic.co/u/kayyazka)\
**Post date:** [June 23, 2016, 2:47am UTC](https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728/1 "2016-06-23T02:47:18Z")

</div>

Hi All,

I have problem about Logstash,.  
Log from logstash.log

{:timestamp=\>"2016-06-23T09:17:41.150000+0700", :message=\>"failed to open /var/log/messages: Permission denied - /var/log/messages", :level=\>:warn}  
{:timestamp=\>"2016-06-23T09:17:48.033000+0700", :message=\>"failed to open /var/log/messages: Permission denied - /var/log/messages", :level=\>:warn}  
{:timestamp=\>"2016-06-23T09:22:42.483000+0700", :message=\>"failed to open /var/log/messages: Permission denied - /var/log/messages", :level=\>:warn}  
{:timestamp=\>"2016-06-23T09:22:49.027000+0700", :message=\>"failed to open /var/log/messages: Permission denied - /var/log/messages", :level=\>:warn}  
{:timestamp=\>"2016-06-23T09:27:43.793000+0700", :message=\>"failed to open /var/log/messages: Permission denied - /var/log/messages", :level=\>:warn}  
{:timestamp=\>"2016-06-23T09:27:50.400000+0700", :message=\>"failed to open /var/log/messages: Permission denied - /var/log/messages", :level=\>:warn}  
{:timestamp=\>"2016-06-23T09:32:44.419000+0700", :message=\>"failed to open /var/log/messages: Permission denied - /var/log/messages", :level=\>:warn}

i follow this link :

> <https://serverfault.com/questions/527706/logstash-cant-read-files-it-should-have-access-too>

  

> **[Logstash: fixing permission denied errors - Gary Sieling](https://www.garysieling.com/blog/2769-2)**
>
> If you set up logstash to monitor /var/log, you may get errors like this: {:timestamp=\>"2015-12-21T17:21:42.809000+0000", :message=\>"failed to open /var/log/auth.log: Permission denied - /var/log/auth.log", :level=\>:warn}...

but can not solve my problem.what should i do to fix it?

thank you in advance

---

<div class="post-metadata">

**Author:** ![yodog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yodog/32/4822_2.png) [@yodog](https://discuss.elastic.co/u/yodog)\
**Post date:** [June 23, 2016, 7:12pm UTC](https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728/2 "2016-06-23T19:12:48Z")

</div>

your error `Permission denied` is telling you exactly what is wrong.

post everything that you tried.

---

<div class="post-metadata">

**Author:** ![kayyazka](https://avatars.discourse-cdn.com/v4/letter/k/a698b9/32.png) [@kayyazka](https://discuss.elastic.co/u/kayyazka)\
**Post date:** [June 24, 2016, 4:16am UTC](https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728/3 "2016-06-24T04:16:12Z")

</div>

Hi,

I add this configuration at /etc/logstash/conf.d/logstash.conf

input {  
file {  
path =\> "/var/log/messages"  
type =\> "syslog"  
}

file {  
path =\> "/var/log/nginx/\*.log"  
type =\> "nginx"  
}  
}

output {  
elasticsearch {  
hosts =\> localhost  
}  
stdout { codec =\> json }

thank you

---

<div class="post-metadata">

**Author:** ![yodog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yodog/32/4822_2.png) [@yodog](https://discuss.elastic.co/u/yodog)\
**Post date:** [June 24, 2016, 12:50pm UTC](https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728/4 "2016-06-24T12:50:22Z")

</div>

right, but what permissions did you give to those files?  
who is the owner/group?

---

<div class="post-metadata">

**Author:** ![kayyazka](https://avatars.discourse-cdn.com/v4/letter/k/a698b9/32.png) [@kayyazka](https://discuss.elastic.co/u/kayyazka)\
**Post date:** [June 27, 2016, 2:49am UTC](https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728/5 "2016-06-27T02:49:56Z")

</div>

Hi,

it is  
-rw-r--r--. 1 nginx root 596118 Jun 26 06:25 /var/log/nginx/access.log  
-rw-r--r--. 1 nginx root 21464 Jun 26 06:24 /var/log/nginx/error.log  
[root@sysadmin cloud-user]# ll /var/log/messages  
-rw-------. 1 root root 92153 Jun 27 04:18 /var/log/messages

thanks

---

<div class="post-metadata">

**Author:** ![yodog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yodog/32/4822_2.png) [@yodog](https://discuss.elastic.co/u/yodog)\
**Post date:** [July 1, 2016, 1:37am UTC](https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728/6 "2016-07-01T01:37:21Z")

</div>

you must give permission to user or group `logstash` to access the log file.

that's all.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:50am UTC](https://discuss.elastic.co/t/logstash-cant-read-files-permission-denied/53728/7 "2017-07-06T04:50:00Z")

</div>