Metricbeat does not respect on output.file.permissions

Hi, my metricbeat config for file output is this:

output.file:
  # Boolean flag to enable or disable the output module.
  enabled: True

  # Configure JSON encoding
  #codec.json:
    # Pretty-print JSON event
    #pretty: false

    # Configure escaping HTML symbols in strings.
    #escape_html: false

  # Path to the directory where to save the generated files. The option is
  # mandatory.
  path: "/var/log/metricbeat/probes"

  # Name of the generated files. The default is `metricbeat` and it generates
  # files: `metricbeat`, `metricbeat.1`, `metricbeat.2`, etc.
  filename: metricbeat_probes.log

  # Maximum size in kilobytes of each file. When this size is reached, and on
  # every Metricbeat restart, the files are rotated. The default value is 10240
  # kB.
  rotate_every_kb: 10240

  # Maximum number of files under path. When this number of files is reached,
  # the oldest file is deleted and the rest are shifted from last to first. The
  # default is 7 files.
  number_of_files: 3

  # Permissions to use for file creation. The default is 0600.
  permissions: 0644

But the created files have 0640 permissions:

[root@elastic01 probes]# pwd
/var/log/metricbeat/probes
[root@elastic01 probes]# ls -l
total 68
-rw-r-----. 1 metricbeat metricbeat 68454 Apr  9 15:15 metricbeat_probes.log

I am using metricbeat 7.5.2.
I am running metricbeat as unprivilleged user called metricbeat.

Any ideas how to solve this issue?

same issue when running as root

Thanks for posting your question here. I was able to reproduce this issue with master branch Metricbeat. I see INFO log showing:

2020-04-10T13:59:56.887-0600    INFO    [file]  fileout/file.go:100     Initialized file output. path=/Users/kaiyansheng/metricbeat-logs/metricbeat_probes.log max_size_bytes=10485760 max_backups=3 permissions=-rw-r--r--

But still the output log file is

-rw-r-----   1 kaiyansheng  staff    17K Apr 10 13:56 metricbeat_probes.log

Could you please create an issue for this in Beats github repo please?

Here it is

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.