Hi,
We have successfully configured Filebeat ELK stack using a modified version of GitHub - geerlingguy/ansible-role-filebeat: Ansible Role - Filebeat for ELK stack.
However each of our node services runs as a separate user, i.e. [servicename]_user, and the logs are only readable by [servicename]_user & root.
We don’t want to run Filebeat as root, so my question is is it possible to run multiple instances of Filebeat as different users, i.e. one for each service?
Further, is it possible to rename the Filebeat service to e.g. filebeat-appname? I ask this as Ansible uses the service name as an input to ensure it is started at the end of the playbook.