# Logstash can't run as non-privileged user logstash

**URL:** <https://discuss.elastic.co/t/logstash-cant-run-as-non-privileged-user-logstash/27535>\
**Category:** Logstash\
**Created:** [August 17, 2015, 7:58pm UTC](https://discuss.elastic.co/t/logstash-cant-run-as-non-privileged-user-logstash/27535 "2015-08-17T19:58:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bdunbar](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@bdunbar](https://discuss.elastic.co/u/bdunbar)\
**Post date:** [August 17, 2015, 7:58pm UTC](https://discuss.elastic.co/t/logstash-cant-run-as-non-privileged-user-logstash/27535/1 "2015-08-17T19:58:16Z")

</div>

Ubuntu 12.04  
Logstash 1.5.3

Logstash launches, but does not forward log files as user 'logstash'. It can (I know, I know, this is Wrong Of Me) as user root. I am confused.

(I will add that I've spent most of the last year messing around with CentOS and RedHat Machines, so I might be Missing Something with Ubuntu.)

shipper conf file

```
root@ip-172-20-11-51:/etc/logstash/conf.d# ls -ltrh
total 4.0K
-rw-r--r-- 1 logstash logstash 139 Aug 14 19:23 01logstash_shipper.conf

cat 01logstash_shipper.conf
input { file { path => "/var/log/syslog*"} }

output {
redis {
 host => '172.20.255.224'
 data_type => 'list'
 key => 'logstash:redis'
}
}

```

receiver conf file

```
    input {
    redis {
      host => 'localhost'
      data_type => 'list'
      key => 'logstash:redis'
      type => 'redis-input'
    }
    } 

output {file { path => "/var/log/combined/syslog"} }

```

As user Logstash, stripped from the init script so I can see what is going on.

```
# su - logstash
logstash@ip-172-20-11-51:~$ /opt/logstash/bin/logstash agent -f /etc/logstash/conf.d/01logstash_shipper.conf -l /var/log/logstash/test2.log

```

Nothing in output to the destination file /var/log/combined/syslog

As user root ...

```
root@ip-172-20-11-51:/etc/logstash/conf.d# /opt/logstash/bin/logstash agent -f /etc/logstash/conf.d/01logstash_shipper.conf -l /var/log/logstash/test2.log
Sending logstash logs to /var/log/logstash/test2.log.

```

And output just _flies_ into it ...

```
root@ip-172-20-11-51:/etc/logstash/conf.d# logger TEST7
root@ip-172-20-11-51:/etc/logstash/conf.d#

tail -f /var/log/combined/syslog

{"message":"Aug 17 19:56:40 ip-172-20-11-51 ubuntu: TEST6","@version":"1","@timestamp":"2015-08-17T19:56:46.629Z","host":"0.0.0.0","path":"/var/log/syslog","type":"redis-input"}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 17, 2015, 8:10pm UTC](https://discuss.elastic.co/t/logstash-cant-run-as-non-privileged-user-logstash/27535/2 "2015-08-17T20:10:30Z")

</div>

First of all you need to make sure the logstash user is a member of the adm group so that it has permissions to read e.g. /var/log/syslog.

Secondly, there's a bug in 12.04's Upstart that prevents secondary groups from being added to started processes (i.e. Logstash processes started via Upstart won't actually be a member of e.g. the adm group regardless of what /etc/group says). Logstash implemented a fix for this ([github.com/elastic/logstash pull request #1398](https://github.com/elastic/logstash/pull/1398)) that I believe is included in Logstash 1.5.3 so you should be okay.

(Side note: If you really want to use /var/log/syslog\* as a wildcard, make sure you also exclude \*.gz.)

---

<div class="post-metadata">

**Author:** ![bdunbar](https://avatars.discourse-cdn.com/v4/letter/b/a3d4f5/32.png) [@bdunbar](https://discuss.elastic.co/u/bdunbar)\
**Post date:** [August 17, 2015, 9:04pm UTC](https://discuss.elastic.co/t/logstash-cant-run-as-non-privileged-user-logstash/27535/3 "2015-08-17T21:04:43Z")

</div>

Adding the user to group adm did the trick. And thanks, I eliminated the wildcard - that was not what I intended.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:31am UTC](https://discuss.elastic.co/t/logstash-cant-run-as-non-privileged-user-logstash/27535/4 "2017-07-06T05:31:43Z")

</div>