# Running filebeat as a different user or service account on Centos 6.5

**URL:** <https://discuss.elastic.co/t/running-filebeat-as-a-different-user-or-service-account-on-centos-6-5/63200>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 17, 2016, 3:52pm UTC](https://discuss.elastic.co/t/running-filebeat-as-a-different-user-or-service-account-on-centos-6-5/63200 "2016-10-17T15:52:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jinal.shah](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jinal.shah](https://discuss.elastic.co/u/jinal.shah)\
**Post date:** [October 17, 2016, 3:52pm UTC](https://discuss.elastic.co/t/running-filebeat-as-a-different-user-or-service-account-on-centos-6-5/63200/1 "2016-10-17T15:52:38Z")

</div>

Hello

What is the best way to run / start filebeat as a different user or service account on Centos 6.5?

Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 17, 2016, 4:17pm UTC](https://discuss.elastic.co/t/running-filebeat-as-a-different-user-or-service-account-on-centos-6-5/63200/2 "2016-10-17T16:17:31Z")

</div>

I think you would have to make some modifications to /etc/init.d/filebeat. I haven't tried any of this, but here's what I would try.

Add `--user USER --group GROUP` to the [`wrapperopts`](https://github.com/elastic/beats/blob/master/dev-tools/packer/platforms/centos/init.j2#L30) in the init file. `USER` and `GROUP` are what you want to run Filebeat as. These will get passed to filebeat-god which is actually the [go-daemon](https://github.com/tsg/go-daemon/blob/master/god.c#L35-L36).

The other things you will need to account for are privileges on

- the config files that Filebeat reads,
- the directories where Filebeat writes logs and the registry file,
- and the logs files that Filebeat is reading and the directories containing them.

The user must have read permissions on the log files and must have search permissions (the execute bit) on the directory containing the log files. Filebeat uses `stat` to collect the inode of the file and `stat` requires the execute permissions on the directory according to its [man page](http://linux.die.net/man/2/stat).

For other CentOS users that find this thread, if you are on Centos 7 you need to modify the systemd unit file and not the init.d script.

---

<div class="post-metadata">

**Author:** ![jinal.shah](https://avatars.discourse-cdn.com/v4/letter/j/3da27b/32.png) [@jinal.shah](https://discuss.elastic.co/u/jinal.shah)\
**Post date:** [October 17, 2016, 4:19pm UTC](https://discuss.elastic.co/t/running-filebeat-as-a-different-user-or-service-account-on-centos-6-5/63200/3 "2016-10-17T16:19:47Z")

</div>

Hi Andrew

Thanks! I'll give that a go and let you know how I get on.

Cheers!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2016, 3:52pm UTC](https://discuss.elastic.co/t/running-filebeat-as-a-different-user-or-service-account-on-centos-6-5/63200/4 "2016-11-07T15:52:52Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.