Problems reading file by logstash input plugin (permissions)

Elastic Stack Logstash
1

Which permissions has to be set for a file read by input plugin of logstash ?

Following situation:

Logstash is running as service with user/group logstash/logstash.
Input plugin of logstash should read the file /home/myuser/subdir/log/env/error.log.

File error.log has following permissions and ownership:

-rw-rwxr--+ 1 myuser mygroup 2096306521 Jul 30 08:25 /home/myuser/subdir/log/env/error_log

The Directories have following permissions and ownership:

drwxr-xr-x. 24 root root 4096 Jan 26 2024 /home
drwxrwx---+ 14 myuser mygroup 4096 Jul 25 13:44 /home/myuser/
drwxrwxr-x+ 20 myuser mygroup 4096 Jan 16 2025 /home/myuser/subdir/
drwxrwxr-x+ 7 myuser mygroup 4096 Jul 22 05:37 /home/myuser/subdir/log/
drwxrwxr-x+ 2 myuser mygroup4096 Jul 28 15:33 /home/myuser/subdir/log/env

The user logstash is member of group logstash and mygroup.

Why is it not possible for the input plugin to read the log file ? What’s wrong in the configuration ?

Version of Logstash: 7.17.29

Thnx for any help !

2

I would suggest testing "chmod o+x /home/myuser/". It will need execute permission on the directory to open the subdir entry within it.

And yes, I realize that mygroup has full access to the directory. I still suggest that you try it and see whether it changes anything.

3

@Badger - unfortunately it doesn't change anything.

4

Maybe logs were already read if you not set sincedb_path in-memory database - /dev/null.

Can you enable the debug log.level and restart LS?

5

Thnx for all ansers. Meanwhile I found the reason. The reason is the ACL which is additional configured for the home directory of the user. I don't know who configured that, but it has to be changed.

1 Like