Problem with exec output

Elastic Stack Logstash
#1

Hello,

I'm having problems when using exec output.
What i'm trying is exec a command. This command is aws cli (which is installed).
However i get no errors when logstash executes the command.

I think it deals with the user "logstash" who is running logstash. I don't know how may i execute that command with another user.
If i try sudo -S ... aws ... it won't work as i don't know the password of the user logstash (created auto when installs ELK).

How may i proceed?

Thank you

#2

The exec output doesn't allow you to select which user to run the command as. A major reason for this is that Logstash typically runs as the logstash user which can't change its effective uid. You have a number of options:

  • Change file permissions or whatever so that the logstash user can run the aws command.
  • Write a service that runs as a user with access to run the aws command and have Logstash fire requests to that service via some output.
  • Create a setuid binary that invokes aws as another user.
  • Allow the logstash user to run the aws command via password-less sudo.
  • Run Logstash as root and use su or sudo.
#3

Hi Magnus,

Before writing the post i tried the firts and 4th options with no success.
Finally i have had success with your second option.

Thanks

#4