# What permissions does logstash need to run as a service?

**URL:** <https://discuss.elastic.co/t/what-permissions-does-logstash-need-to-run-as-a-service/52753>\
**Category:** Logstash\
**Created:** [June 14, 2016, 3:18pm UTC](https://discuss.elastic.co/t/what-permissions-does-logstash-need-to-run-as-a-service/52753 "2016-06-14T15:18:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Edely\_Gomes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edely_gomes/32/9872_2.png) [@Edely\_Gomes](https://discuss.elastic.co/u/Edely_Gomes)\
**Post date:** [June 14, 2016, 3:18pm UTC](https://discuss.elastic.co/t/what-permissions-does-logstash-need-to-run-as-a-service/52753/1 "2016-06-14T15:18:44Z")

</div>

I am running Logstash as a service, but it doesn't collect the logs.

But when I run the bynary (bin/logstash -f test.conf) I collect the logs. And in the two cases I am using the same .conf file.

In other posts it is said I need to give Logstash permissions, but I've been unable to identify what files/folders have to be granted permission.

Could someone point that? Thanks in advance!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 14, 2016, 8:02pm UTC](https://discuss.elastic.co/t/what-permissions-does-logstash-need-to-run-as-a-service/52753/2 "2016-06-14T20:02:31Z")

</div>

Assuming you're using the standard installation directories the user that Logstash runs as should have read/write access to /var/lib/logstash and /var/log/logstash. That's all it takes for Logstash to run properly, but obviously if you've configured it to read additional log files the same user needs read access to those too.

---

<div class="post-metadata">

**Author:** ![Edely\_Gomes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/edely_gomes/32/9872_2.png) [@Edely\_Gomes](https://discuss.elastic.co/u/Edely_Gomes)\
**Post date:** [July 1, 2016, 3:36pm UTC](https://discuss.elastic.co/t/what-permissions-does-logstash-need-to-run-as-a-service/52753/3 "2016-07-01T15:36:46Z")

</div>

So, I had to put this aside for the last two weeks, but yesterday I came back to it and now it is working. All I had to do was add Logstash to adm group, as follows:

`sudo usermod -a -G adm logstash`

And then restart it

`sudo service logstash restart`

I am a newbie so I'm not sure if logstash should be automatically added to adm group at the installation or be granted with permissions that would allow it to read the logs.

In my case, all I wanted was to read apache logs. My input configuration was correct but wasn't working:

```
input {
   file{
      path => '/var/log/apache2/*'
      exclude => "*.gz"
      start_position => "beginning"
      sincedb_path => "/dev/null"
      type => "apache-access"
   }
}

[...]

```

Now works.

Maybe this problem is related to [this bug](https://github.com/elastic/logstash/pull/1398), which would be strange, since I using version 2.3 and the bug was fixed in version 1.5.

Anyway, here it is. I did this way, but I don't know if it is a good pratice to add Logstash to the adm group. If someone has a better solution, please, let me know so I can see how it works.

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 1, 2016, 5:51pm UTC](https://discuss.elastic.co/t/what-permissions-does-logstash-need-to-run-as-a-service/52753/4 "2016-07-01T17:51:41Z")

</div>

Adding Logstash to the adm group is typical to gain access to the log files.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:49am UTC](https://discuss.elastic.co/t/what-permissions-does-logstash-need-to-run-as-a-service/52753/5 "2017-07-06T04:49:51Z")

</div>