Permission denied /usr/share/logstash/run

[RJC (Romuald (George) Czajkowski)]

I am getting the following error message when starting Logstash on a Linux server:

[ERROR][logstash.java.pipeline ][main] Pipeline worker error, the pipeline will be stopped (:pipeline_id=>"main", :error=>" (EACCESS) Permission denied - /usr/share/logstash/run".

I looked into /usr/share/logstash directory, but it does not contain "run" subdirectory.

I tried to Google for this error, but did not find anything applicable. Any suggestions how to fix this problem?

[Rios]

Check permission on data and log directories. Here are locations.

[warkolm (Mark Walkom)]

Welcome to our community!

How did you install Logstash exactly, deb/rpm, tar.gz?

[RJC (Romuald (George) Czajkowski)]

Sorry for delay in responding, but I was able to identify the root cause and fix the problem. It turned out to be trivial!

The problem was that the person who created the output config file for Logstash to write syslog messages to hard drive, wrote the path for the directory where the messages were to be written without the initial forward slash, thus making the path relative, instead of absolute. This caused Logstash to attempt to write files to a non existing directory (using /usr/share/logstash as starting point, which was not as intended) which of course resulted in the access permission error.

Once I converted the paths to absolute and restarted logstash the problem disappeared.