Run Filebeats as Non-Root User

Hi folks,

i´m trying to run Filebeat as a non root user on RHEL 7.5. What have i done:

chown for /etc/filebeat , /var/log/filebeat ,/usr/share/filebeat and /var/lib/filebeat.

The user is now owner of this directorys...

If i start filebeat with
/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -
path.config /etc/filebeat /var/lib/filebeat -path.logs /var/log/filebeat

everything works fine.

But if i try to start it via /etc/init.d/filebeat or systemctl -> i get the prompt to enter the root password.

I also changed the user in the /etc/init.d/filebeat :

This changed anything. Are there any ideas, how to fix this?


Doesn't RHEL 7 use systemd? If so then the SysV files in /etc/init.d are not used. Instead you need to edit the systemd unit for Filebeat to set User=<user>. Here's a good starting point if you aren't familiar with editing units.

I think you basically want to do a systemctl edit and set


Thanks a lot. Yes, RHEL uses systemd. I will try this (actually i dont have the permission to edit systemctl, wait for the sysadmin...) and tell the result.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.