# Run Filebeats as Non-Root User

**URL:** <https://discuss.elastic.co/t/run-filebeats-as-non-root-user/198374>\
**Category:** Beats\
**Created:** [September 6, 2019, 8:44am UTC](https://discuss.elastic.co/t/run-filebeats-as-non-root-user/198374 "2019-09-06T08:44:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![thps](https://avatars.discourse-cdn.com/v4/letter/t/f19dbf/32.png) [@thps](https://discuss.elastic.co/u/thps)\
**Post date:** [September 6, 2019, 8:44am UTC](https://discuss.elastic.co/t/run-filebeats-as-non-root-user/198374/1 "2019-09-06T08:44:47Z")

</div>

Hi folks,

i´m trying to run Filebeat as a non root user on RHEL 7.5. What have i done:

1. 

chown for /etc/filebeat , /var/log/filebeat ,/usr/share/filebeat and /var/lib/filebeat.

The user is now owner of this directorys...

If i start filebeat with  
/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -  
path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat

everything works fine.

But if i try to start it via /etc/init.d/filebeat or systemctl -\> i get the prompt to enter the root password.

I also changed the user in the /etc/init.d/filebeat :  
beat\_user="${BEAT\_USER:-newuser}"

This changed anything. Are there any ideas, how to fix this?

greetz

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 6, 2019, 2:04pm UTC](https://discuss.elastic.co/t/run-filebeats-as-non-root-user/198374/2 "2019-09-06T14:04:12Z")

</div>

Doesn't RHEL 7 use systemd? If so then the SysV files in /etc/init.d are not used. Instead you need to edit the systemd unit for Filebeat to set `User=<user>`. Here's a good starting point if you aren't familiar with editing units. [https://askubuntu.com/a/659268](https://askubuntu.com/a/659268)

I think you basically want to do a `systemctl edit` and set

```auto
[Service]
Unit=newuser

```

---

<div class="post-metadata">

**Author:** ![thps](https://avatars.discourse-cdn.com/v4/letter/t/f19dbf/32.png) [@thps](https://discuss.elastic.co/u/thps)\
**Post date:** [September 9, 2019, 9:40am UTC](https://discuss.elastic.co/t/run-filebeats-as-non-root-user/198374/3 "2019-09-09T09:40:44Z")

</div>

Thanks a lot. Yes, RHEL uses systemd. I will try this (actually i dont have the permission to edit systemctl, wait for the sysadmin...) and tell the result.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 7, 2019, 11:40am UTC](https://discuss.elastic.co/t/run-filebeats-as-non-root-user/198374/4 "2019-10-07T11:40:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.