# Strange Logstash Running Issue

**URL:** <https://discuss.elastic.co/t/strange-logstash-running-issue/130359>\
**Category:** Logstash\
**Created:** [May 3, 2018, 4:36am UTC](https://discuss.elastic.co/t/strange-logstash-running-issue/130359 "2018-05-03T04:36:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AloysiusParedes](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@AloysiusParedes](https://discuss.elastic.co/u/AloysiusParedes)\
**Post date:** [May 3, 2018, 4:36am UTC](https://discuss.elastic.co/t/strange-logstash-running-issue/130359/1 "2018-05-03T04:36:16Z")

</div>

I have a strange issue on my ELK stack. I have ELK installed as a service that starts up as soon as my RHEL Virtual Machine (via Oracle VirtualBox) server starts. But for some reason, none of my documents are being ingested via Logstash. But when I stop the service, and manually run Logstash via:

`sudo ./logstash -f /etc/logstash/conf.d/myConfig.conf --path.settings /etc/logstash/`

Then the files get ingested into Elasticsearch.

Please also note that the files being ingested by Logstash are in a Shared Folder that is the path set for the file{} input in myConfig.conf. Why does it ingest okay when I run Logstash manually and not when it is run as a service?

Has anyone else run into this issue?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 3, 2018, 4:46am UTC](https://discuss.elastic.co/t/strange-logstash-running-issue/130359/2 "2018-05-03T04:46:41Z")

</div>

It looks like you are manually running it as root, which the service typically would not, so it might be that the ‘logstash’ user does not have access to config or data files.

---

<div class="post-metadata">

**Author:** ![AloysiusParedes](https://avatars.discourse-cdn.com/v4/letter/a/e9c0ed/32.png) [@AloysiusParedes](https://discuss.elastic.co/u/AloysiusParedes)\
**Post date:** [May 4, 2018, 2:43pm UTC](https://discuss.elastic.co/t/strange-logstash-running-issue/130359/3 "2018-05-04T14:43:12Z")

</div>

That was the issue!

Fixed it by adding the "logstash" user to have permission to the shared folder:

adding: vboxsf:x:992:logstash  
to: /etc/group

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2018, 2:43pm UTC](https://discuss.elastic.co/t/strange-logstash-running-issue/130359/4 "2018-06-01T14:43:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.