# User setting - looking for best practice **URL:** \ **Category:** Logstash\ **Created:** [January 26, 2018, 8:25pm UTC](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264 "2018-01-26T20:25:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Post date:** [January 26, 2018, 8:25pm UTC](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264/1 "2018-01-26T20:25:11Z")
Hi, I am running logstash on my centOS machine using a user that I created "elastic" This user needs to be able to run data ingestion for various tests. This user needs to write to `/var/log/logstash` And to `/usr/share/logstash/data/queue/` and `/usr/share/logstash/data/dead_letter_queue` You find which directories by running and failing and reading the output logs until you get it right So I added the logstash group to my user, but those locations have no group writable access. I can add this access of course, but wasn't sure if there is no better way people use. Perhaps turn "logstash" into a full user? Thank you in advance. JD ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 28, 2018, 9:34pm UTC](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264/2 "2018-01-28T21:34:35Z")
Why not just use the logstash user created by the RPM installation? ---
**Author:** ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Post date:** [January 29, 2018, 12:57pm UTC](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264/3 "2018-01-29T12:57:02Z")
The logstash user was created by the RPMs as a non-active (no shell) user, and I assumed this is done for some purpose. If you say the logstash user is the best user to use, then I will start doing it. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 29, 2018, 7:41pm UTC](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264/4 "2018-01-29T19:41:43Z")
> [@dorj1234](#): > > The logstash user was created by the RPMs as a non-active (no shell) user, and I assumed this is done for some purpose. Why do you need to login as that user? ---
**Author:** ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)\ **Post date:** [January 29, 2018, 8:27pm UTC](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264/5 "2018-01-29T20:27:29Z")
To develop my config scripts, arrange csv data files and locations. So I created a separate "elastic" user for all that, but then I found out that it's not so easy to run them with that "elastic" user. So my options are: 1. Create/develop logstash scripts/conf with my "elastic" user, then copy them to /etc/logstash/conf.d and make the csv data files accessible to the logstash user 2. Make logstash a real user and work with it 3. Use the elastic user for running as well as developing for logstash (not working smoothly) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 26, 2018, 8:27pm UTC](https://discuss.elastic.co/t/user-setting-looking-for-best-practice/117264/6 "2018-02-26T20:27:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.