No such file or directory - tmp

Elastic Stack Logstash
1

Hi,

Logstash is installed in read & execute only folder.
I am trying to execute logstash with elasticsearch input plugin.
My configuration:

input {
        elasticsearch {
                host => "xx.xx.xx.xx"
                index => "logstash-test-2015.07.*"
        }
}

filter {
        mutate {
                replace => [ "type", "log.%{type}" ]
        }
}

output {
        elasticsearch {
                host => "localhost"
                protocol => "http"
                index => "logstash-%{+YYYY.MM.dd}"
        }
}

But I get an error:

No such file or directory - No such file or directory - /.../tmp
2

Is there any other config files that contain that path?

3

@warkolm
I don't think so.
But how does that affect?

Also I have one query? Do we need write permissions for folder in which Logstash is running?

4

I don't think so.
But how does that affect?

Well, it's a bogus path and it's coming from somewhere. Are there really three periods in it? Can you give more context from the log? Anything interesting if you turn up the log level with --verbose or --debug?

Also I have one query? Do we need write permissions for folder in which Logstash is running?

No.

5

Oh Sorry. that /.../ is a long path on my server. I just replaced it with three periods.
But the point is, it raised an error saying that this tmp folder doesn't exist.

Also, when transferring data from one elasticsearch to another, I tried above logstash configuration on destination server and got the above error. [Logstash folder on destination, does not have write permissions]
But whereas, when I tried to run logstash on host (by swapping the input and output), then it works.

Do you see any issue here?

6

Also, when transferring data from one elasticsearch to another

What do you mean by this?

Again, is there anything interesting in the logs if you turn up the log level with --verbose or --debug?

7

I mean from one elasticsearch cluster to another new cluster.

I am yet to try that. Will post once I do that.