# Multiple filebeat instances under different accounts on one box?

**URL:** <https://discuss.elastic.co/t/multiple-filebeat-instances-under-different-accounts-on-one-box/80293>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 28, 2017, 12:06pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-under-different-accounts-on-one-box/80293 "2017-03-28T12:06:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rozling](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rozling/32/16401_2.png) [@rozling](https://discuss.elastic.co/u/rozling)\
**Post date:** [March 28, 2017, 12:06pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-under-different-accounts-on-one-box/80293/1 "2017-03-28T12:06:58Z")

</div>

Hi,

We have successfully configured Filebeat ➡ ELK stack using a modified version of [GitHub - geerlingguy/ansible-role-filebeat: Ansible Role - Filebeat for ELK stack](https://github.com/geerlingguy/ansible-role-filebeat).

However each of our node services runs as a separate user, i.e. [servicename]\_user, and the logs are only readable by [servicename]\_user & root.

We don’t want to run Filebeat as root, so my question is is it possible to run multiple instances of Filebeat as different users, i.e. one for each service?

Further, is it possible to rename the Filebeat service to e.g. filebeat-appname? I ask this as Ansible uses the service name as an input to ensure it is started at the end of the playbook.

---

<div class="post-metadata">

**Author:** ![prodrg](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@prodrg](https://discuss.elastic.co/u/prodrg)\
**Post date:** [March 28, 2017, 3:37pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-under-different-accounts-on-one-box/80293/2 "2017-03-28T15:37:59Z")

</div>

Well, running Filebeat instances as another kind of user (not being root) for each, is possible. The only thing to do is to change the permissions on the logs folder to the corresponding user.

And, with systemd, it is also possible to rename the services.

---

<div class="post-metadata">

**Author:** ![rozling](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rozling/32/16401_2.png) [@rozling](https://discuss.elastic.co/u/rozling)\
**Post date:** [March 31, 2017, 12:12pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-under-different-accounts-on-one-box/80293/3 "2017-03-31T12:12:47Z")

</div>

Hi prodrg, thanks for your reply - I eventually got it working for filebeat 1.3 / init.d. Then realised that I needed to do it for filebeat 5.3 / systemd, which I've yet to get working.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2017, 12:12pm UTC](https://discuss.elastic.co/t/multiple-filebeat-instances-under-different-accounts-on-one-box/80293/4 "2017-04-28T12:12:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.