Multiple filebeat instances under different accounts on one box?


We have successfully configured Filebeat :arrow_right: ELK stack using a modified version of GitHub - geerlingguy/ansible-role-filebeat: Ansible Role - Filebeat for ELK stack.

However each of our node services runs as a separate user, i.e. [servicename]_user, and the logs are only readable by [servicename]_user & root.

We don’t want to run Filebeat as root, so my question is is it possible to run multiple instances of Filebeat as different users, i.e. one for each service?

Further, is it possible to rename the Filebeat service to e.g. filebeat-appname? I ask this as Ansible uses the service name as an input to ensure it is started at the end of the playbook.

Well, running Filebeat instances as another kind of user (not being root) for each, is possible. The only thing to do is to change the permissions on the logs folder to the corresponding user.

And, with systemd, it is also possible to rename the services.

Hi prodrg, thanks for your reply - I eventually got it working for filebeat 1.3 / init.d. Then realised that I needed to do it for filebeat 5.3 / systemd, which I've yet to get working.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.