# Logstash fails to open file: Permission denied

**URL:** <https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170>\
**Category:** Logstash\
**Created:** [August 24, 2017, 7:28am UTC](https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170 "2017-08-24T07:28:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hisushi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hisushi/32/20551_2.png) [@Hisushi](https://discuss.elastic.co/u/Hisushi)\
**Post date:** [August 24, 2017, 7:28am UTC](https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170/1 "2017-08-24T07:28:32Z")

</div>

Hi everybody,

I'm currently encountering the error that Logstash is not able to open several files due to a "Permission denied" error

```
[2017-08-24T08:25:43,619][WARN][logstash.inputs.file] failed to open /media/Logs/000000760400001.txt: Permission denied - /media/Logs/000000760400001.txt

```

The files have the following access rights:  
`-rwxr-xr-x 1 elk elk 1348 Aug 17 09:02 000000760400001.txt`  
I'm running Logstash as the user **elk** (who is a member of the **adm** group) so the privileges should be sufficient. I also ran Logstash as a superuser with the same result. I'm running Logstash by executing `elk@ELK:~$ /media/ELKstack/logstash-5.5.1/bin/logstash` as I downloaded the zip files instead of installing from DEB.  
Has anybody an idea of the cause of this error? Interestingly, this does not apply to all files as some are processed.

Best regards,

Hisushi

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 24, 2017, 7:52am UTC](https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170/2 "2017-08-24T07:52:21Z")

</div>

Please show the output of `ls -ld /media /media/Logs`.

---

<div class="post-metadata">

**Author:** ![Hisushi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hisushi/32/20551_2.png) [@Hisushi](https://discuss.elastic.co/u/Hisushi)\
**Post date:** [August 24, 2017, 7:58am UTC](https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170/3 "2017-08-24T07:58:37Z")

</div>

It's  
`drwxr-xr-x 9 root root 4096 Aug 11 14:04 /media`  
`drwxr-xr-x 12 elk elk 4096 Aug 16 16:22 /media/Logs`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 24, 2017, 2:39pm UTC](https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170/4 "2017-08-24T14:39:42Z")

</div>

Hmm, that looks okay. I wonder if a directory ACL or SELinux or something is blocking the access.

---

<div class="post-metadata">

**Author:** ![Vishal\_Sharma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_sharma1/32/20207_2.png) [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)\
**Post date:** [August 24, 2017, 2:45pm UTC](https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170/5 "2017-08-24T14:45:02Z")

</div>

is it CentOS 7?  
In case selinux is enabled please do below  
$ sestatus  
if you see its enabled then  
$ vi /etc/sysconfig/selinux  
find selinux=enforcing and change it to selinux=disabled press :wq to save and quit from the editor.  
Reboot the server you should be fine now

---

<div class="post-metadata">

**Author:** ![Hisushi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hisushi/32/20551_2.png) [@Hisushi](https://discuss.elastic.co/u/Hisushi)\
**Post date:** [August 25, 2017, 7:44am UTC](https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170/6 "2017-08-25T07:44:46Z")

</div>

AFAIK no ACL is applied. And it's a Ubuntu 16.04 machine. Is it possible that it has to to with this "Too many files" error that has been mentioned in different topics?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 22, 2017, 7:44am UTC](https://discuss.elastic.co/t/logstash-fails-to-open-file-permission-denied/98170/7 "2017-09-22T07:44:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
