# Logstash.service can not read nginx access.log

**URL:** <https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066>\
**Category:** Logstash\
**Created:** [October 16, 2017, 9:42am UTC](https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066 "2017-10-16T09:42:00Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bo8888](https://avatars.discourse-cdn.com/v4/letter/b/eb8c5e/32.png) [@bo8888](https://discuss.elastic.co/u/bo8888)\
**Post date:** [October 16, 2017, 9:42am UTC](https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066/1 "2017-10-16T09:42:00Z")

</div>

vim /etc/systemd/system/logstash.service  
User=logstash  
Group=logstash

/etc/logstash/conf.d/nginx.conf

it is not work well

but  
vim /etc/systemd/system/logstash.service  
User=root  
Group=root

it is work well

access.log user :nginx group:nginx

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 16, 2017, 11:52am UTC](https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066/2 "2017-10-16T11:52:37Z")

</div>

Show `ls -l` output for the logfile in question as well as all directories leading up to it.

---

<div class="post-metadata">

**Author:** ![bo8888](https://avatars.discourse-cdn.com/v4/letter/b/eb8c5e/32.png) [@bo8888](https://discuss.elastic.co/u/bo8888)\
**Post date:** [October 16, 2017, 12:17pm UTC](https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066/3 "2017-10-16T12:17:41Z")

</div>

[root@bogon ~]# ll /var/log/nginx/access.log  
-rw-rw-r--. 1 nginx nginx 23406 10月 16 17:20 /var/log/nginx/access.log

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 16, 2017, 12:33pm UTC](https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066/4 "2017-10-16T12:33:59Z")

</div>

And what about /var, /var/log, and /var/log/nginx?

---

<div class="post-metadata">

**Author:** ![bo8888](https://avatars.discourse-cdn.com/v4/letter/b/eb8c5e/32.png) [@bo8888](https://discuss.elastic.co/u/bo8888)\
**Post date:** [October 16, 2017, 12:35pm UTC](https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066/5 "2017-10-16T12:35:43Z")

</div>

drwx------. 2 nginx nginx 159 10月 16 09:16 nginx  
drwxr-xr-x. 13 root root 4096 10月 16 09:16 log

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 16, 2017, 2:00pm UTC](https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066/6 "2017-10-16T14:00:54Z")

</div>

The nginx directory is clearly only accessible to the nginx user. The logstash user needs the executable bit set (possibly also the read bit depending on how the wildcard expansion has been implemented).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2017, 2:01pm UTC](https://discuss.elastic.co/t/logstash-service-can-not-read-nginx-access-log/104066/7 "2017-11-13T14:01:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.