Strange Logstash Running Issue

Elastic Stack Logstash
1

I have a strange issue on my ELK stack. I have ELK installed as a service that starts up as soon as my RHEL Virtual Machine (via Oracle VirtualBox) server starts. But for some reason, none of my documents are being ingested via Logstash. But when I stop the service, and manually run Logstash via:

sudo ./logstash -f /etc/logstash/conf.d/myConfig.conf --path.settings /etc/logstash/

Then the files get ingested into Elasticsearch.

Please also note that the files being ingested by Logstash are in a Shared Folder that is the path set for the file{} input in myConfig.conf. Why does it ingest okay when I run Logstash manually and not when it is run as a service?

Has anyone else run into this issue?

2

It looks like you are manually running it as root, which the service typically would not, so it might be that the ‘logstash’ user does not have access to config or data files.

3

That was the issue!

Fixed it by adding the "logstash" user to have permission to the shared folder:

adding: vboxsf:x:992:logstash
to: /etc/group

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.