# Question about permission for file input \[Linux\]

**URL:** <https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108>\
**Category:** Logstash\
**Created:** [December 7, 2021, 9:48am UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108 "2021-12-07T09:48:01Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fosco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fosco/32/94297_2.png) [@Fosco](https://discuss.elastic.co/u/Fosco)\
**Post date:** [December 7, 2021, 9:48am UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108/1 "2021-12-07T09:48:01Z")

</div>

Hi,

I have some scripts which download files and need to be read and deleted by logstash afterwards  
Regarding the permission, the files must be logstash:logstash or only the folder containing the files?

Thanks !

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 7, 2021, 2:27pm UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108/3 "2021-12-07T14:27:56Z")

</div>

The user running logstsh needs to have permission on the files as well or it will not be able to delete them.

I have the same use case, some scripts download files, put it in a folder, and logstash reads and delete after processing, the `logstash` user runs the script, owns the folder and files and runs the logstash service.

I would not recommend to run logstash as root for security reasons.

---

<div class="post-metadata">

**Author:** ![Fosco](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fosco/32/94297_2.png) [@Fosco](https://discuss.elastic.co/u/Fosco)\
**Post date:** [December 7, 2021, 2:42pm UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108/4 "2021-12-07T14:42:57Z")

</div>

> [@leandrojmp](#):
>
> I have the same use case, some scripts download files, put it in a folder, and logstash reads and delete after processing, the `logstash` user runs the scrip

I see, but I can't run something as logstash user : "This account is currently not available"  
do I have to do something for this to be possible ?  
Thanks

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 7, 2021, 5:36pm UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108/5 "2021-12-07T17:36:56Z")

</div>

It depends on how you are running it, if is something that is running on crontab, you can configure the cron to run as the logstash user.

You do not need to run as the logstash user, you just need to make sure that the user running logstash can read and write the files you want to collect and delete.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [December 8, 2021, 11:20am UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108/6 "2021-12-08T11:20:04Z")

</div>

If you need to change LS user for the service, go to /etc/systemd/system/logstash.service, change  
[Service]  
Type=simple  
_User=logstash_  
_Group=logstash_

And restart service.Of course best option is to put logs in a directory with permission(read,delete) for the logstash user.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 5, 2022, 11:20am UTC](https://discuss.elastic.co/t/question-about-permission-for-file-input-linux/291108/7 "2022-01-05T11:20:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
