Run Filebeats as Non-Root User

Elastic Stack Beats
1

Hi folks,

i´m trying to run Filebeat as a non root user on RHEL 7.5. What have i done:

chown for /etc/filebeat , /var/log/filebeat ,/usr/share/filebeat and /var/lib/filebeat.

The user is now owner of this directorys...

If i start filebeat with
/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -
path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat

everything works fine.

But if i try to start it via /etc/init.d/filebeat or systemctl -> i get the prompt to enter the root password.

I also changed the user in the /etc/init.d/filebeat :
beat_user="${BEAT_USER:-newuser}"

This changed anything. Are there any ideas, how to fix this?

greetz

2

Doesn't RHEL 7 use systemd? If so then the SysV files in /etc/init.d are not used. Instead you need to edit the systemd unit for Filebeat to set User=<user>. Here's a good starting point if you aren't familiar with editing units. https://askubuntu.com/a/659268

I think you basically want to do a systemctl edit and set

[Service]
Unit=newuser
3

Thanks a lot. Yes, RHEL uses systemd. I will try this (actually i dont have the permission to edit systemctl, wait for the sysadmin...) and tell the result.