Not processing input/output unless running as root


OS: Debian 10.3

openjdk version "11.0.7" 2020-04-14
OpenJDK Runtime Environment (build 11.0.7+10-post-Debian-3deb10u1)
OpenJDK 64-Bit Server VM (build 11.0.7+10-post-Debian-3deb10u1, mixed mode, sharing)

Logstash 6.8.8

I have a simple configuration with an input (file) and an output (file).
When running under the logstash user, it doesn't seem to process anything, but I don't see any errors when setting the log level to debug or trace.

When running logstash as root, everything works fine.

have you tried running logstash from CLI to see what could be the problem? The only idea that i can think of is that your input is trying to use resources that is only writable / accessible by root. This could be registry path for input, or permission of the input, or permission to write the output

1 Like

Indeed it's the input file that is not readable by the logstash user.
I would have expected this to appear in the logs when I run logstash with loglevel debug/trace or from CLI, but couldn't find any error or notification on that.


Be careful, it sometime happens also when the file is readable by logstash BUT under a root:root folder which logstash cannot cross and even spot.
You can see if logstash started watching a file with the presence / absence of a sincedb file that tracks logstash reading position.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.