# Logstash parsing only if run as root

**URL:** <https://discuss.elastic.co/t/logstash-parsing-only-if-run-as-root/61032>\
**Category:** Logstash\
**Created:** [September 20, 2016, 5:09pm UTC](https://discuss.elastic.co/t/logstash-parsing-only-if-run-as-root/61032 "2016-09-20T17:09:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rwagner](https://avatars.discourse-cdn.com/v4/letter/r/d9b06d/32.png) [@rwagner](https://discuss.elastic.co/u/rwagner)\
**Post date:** [September 20, 2016, 5:09pm UTC](https://discuss.elastic.co/t/logstash-parsing-only-if-run-as-root/61032/1 "2016-09-20T17:09:46Z")

</div>

Hi guys, my logstash parsing logs only if run as root.  
Follow the video link showing the problem.

[![](https://us1.discourse-cdn.com/elastic/original/3X/5/4/54f482e70c0f7ab7f408771db85903fb17597039.jpeg "logstash problem") ](https://www.youtube.com/watch?v=V9OcDFIYmbg)

Logstash version:

> yum list installed | grep logstash  
> Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast  
> logstash.noarch 1:2.4.0-1 @logstash-2.4

Logstash.conf:

```
 input {
  file {
    type => "ossec-alerts"
    path => "/var/ossec/logs/alerts/alerts.json"
    codec => "json"
    tags => ['alerts']
}
  tcp {
    port => "5007"
    tags => ["teste"]
  }

filter {
    date {
        match => ["timestamp", "YYYY MMM dd HH:mm:ss"]
        target => "@timestamp"
    }
    mutate {
      convert => ["[geoip][location]", "float"]
      rename => ["hostname", "AgentName"]
      rename => ["_index", "indice"]
      rename => ["geoip", "GeoLocation"]
      rename => ["file", "AlertsFile"]
      rename => ["agentip", "AgentIP"]
      rename => ["[rule][comment]", "[rule][description]" ]
      rename => ["[rule][level]", "[rule][AlertLevel]" ]
      remove_field => ["timestamp", "_score", "[decoder][parent]" ]
    }
}

output {

 elasticsearch {
  hosts => "127.0.0.1:9200"
  index => "ossec-%{+YYYY.MM.dd}"
 }
}

```

Anyone can help?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2016, 5:19pm UTC](https://discuss.elastic.co/t/logstash-parsing-only-if-run-as-root/61032/2 "2016-09-20T17:19:32Z")

</div>

Presumably the user that Logstash otherwise runs as doesn't have permissions to read /var/ossec/logs/alerts/alerts.json.

---

<div class="post-metadata">

**Author:** ![rwagner](https://avatars.discourse-cdn.com/v4/letter/r/d9b06d/32.png) [@rwagner](https://discuss.elastic.co/u/rwagner)\
**Post date:** [September 20, 2016, 5:37pm UTC](https://discuss.elastic.co/t/logstash-parsing-only-if-run-as-root/61032/3 "2016-09-20T17:37:21Z")

</div>

Hy magnus!

I had added Read permission to "others" but had not worked.

```
ls -la /var/ossec/logs/alerts/alerts.json
-rw-r--r-- 2 ossec ossec 174416 Set 20 14:31 /var/ossec/logs/alerts/alerts.json

```

Then I added the logstash user to the file server group and it worked. 😊

Thanks for the light!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 20, 2016, 5:40pm UTC](https://discuss.elastic.co/t/logstash-parsing-only-if-run-as-root/61032/4 "2016-09-20T17:40:17Z")

</div>

The file itself must of course be readable to the logstash user but additionally all directories leading up to the file must be executable.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/logstash-parsing-only-if-run-as-root/61032/5 "2017-07-06T04:37:46Z")

</div>