Question about permission for file input [Linux]

Elastic Stack Logstash
1

Hi,

I have some scripts which download files and need to be read and deleted by logstash afterwards
Regarding the permission, the files must be logstash:logstash or only the folder containing the files?

Thanks !

3

The user running logstsh needs to have permission on the files as well or it will not be able to delete them.

I have the same use case, some scripts download files, put it in a folder, and logstash reads and delete after processing, the logstash user runs the script, owns the folder and files and runs the logstash service.

I would not recommend to run logstash as root for security reasons.

4

I see, but I can't run something as logstash user : "This account is currently not available"
do I have to do something for this to be possible ?
Thanks

5

It depends on how you are running it, if is something that is running on crontab, you can configure the cron to run as the logstash user.

You do not need to run as the logstash user, you just need to make sure that the user running logstash can read and write the files you want to collect and delete.

6

If you need to change LS user for the service, go to /etc/systemd/system/logstash.service, change
[Service]
Type=simple
User=logstash
Group=logstash

And restart service.Of course best option is to put logs in a directory with permission(read,delete) for the logstash user.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.