# Why logstash.err and logstash.stdout are created with root privileges?

**URL:** <https://discuss.elastic.co/t/why-logstash-err-and-logstash-stdout-are-created-with-root-privileges/59890>\
**Category:** Logstash\
**Created:** [September 6, 2016, 2:41pm UTC](https://discuss.elastic.co/t/why-logstash-err-and-logstash-stdout-are-created-with-root-privileges/59890 "2016-09-06T14:41:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Saravanan](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@Saravanan](https://discuss.elastic.co/u/Saravanan)\
**Post date:** [September 6, 2016, 2:41pm UTC](https://discuss.elastic.co/t/why-logstash-err-and-logstash-stdout-are-created-with-root-privileges/59890/1 "2016-09-06T14:41:18Z")

</div>

Hi,

I am new logstash, i've installed logstash-2.2.4 on centos linux and placed my config file at /etc/logstash/conf.d folder and try to start logstash using "service logstash start" command as a root user. By default logstash service getting started as "logstash" user and created following log files at /var/log/logstash.

/var/log/logstash # ls -ltr  
total 8  
-rw-r--r-- 1 root root 0 Sep 1 12:02 logstash.err  
-rw-r--r-- 1 root root 57 Sep 1 12:02 logstash.stdout  
-rw-r--r-- 1 logstash logstash 186 Sep 1 12:02 logstash.log

Couple of queries:

1. why "logstash.err" and "logstash.stdout" log files are created with "root" user priviledges and only logstash.log file getting created as "logstash" user permission?
2. Is there any log/error message will be written to "logstash.err" and "logstash.stdout" once the service is up? seems other than the root...no one have write permission! Just need some understanding/purpose behind these two files.
3. i just installed java, didn't set any JAVA\_HOME or PATH env variables, but logstash picks the java path from /usr/bin/java when it starts ( logstash 23686 1 99 13:19 pts/1 00:00:03 /usr/bin/java).  
i see logstash script is placed at /etc/init.d/logstash and having following entries. How does this works?  
LS\_JAVA\_OPTS="${LS\_JAVA\_OPTS} -Djava.io.tmpdir=${LS\_HOME}"  
HOME=${LS\_HOME}  
export PATH HOME LS\_HEAP\_SIZE LS\_JAVA\_OPTS LS\_USE\_GC\_LOGGING LS\_GC\_LOG\_FILE

Thanks,  
Saravanan

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 8, 2016, 8:18am UTC](https://discuss.elastic.co/t/why-logstash-err-and-logstash-stdout-are-created-with-root-privileges/59890/2 "2016-09-08T08:18:11Z")

</div>

> why "logstash.err" and "logstash.stdout" log files are created with "root" user priviledges and only logstash.log file getting created as "logstash" user permission?

Because logstash.log is created once Logstash has started (as the logstash user) while the other files are created by a root shell before Logstash starts and before its privileges have been dropped.

> Is there any log/error message will be written to "logstash.err" and "logstash.stdout" once the service is up? seems other than the root...no one have write permission! Just need some understanding/purpose behind these two files.

The Logstash process's stdout and stderr streams are already connected to those files when Logstash starts so permissions are not a problem. However, Logstash wouldn't be able to open those files again because it, as you're saying, doesn't have sufficient permissions.

> i just installed java, didn't set any JAVA\_HOME or PATH env variables, but logstash picks the java path from /usr/bin/java when it starts ( logstash 23686 1 99 13:19 pts/1 00:00:03 /usr/bin/java).  
> i see logstash script is placed at /etc/init.d/logstash and having following entries. How does this works

/usr/bin is in the PATH by default so Logstash will pick it up automatically.

---

<div class="post-metadata">

**Author:** ![Saravanan](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@Saravanan](https://discuss.elastic.co/u/Saravanan)\
**Post date:** [September 8, 2016, 8:39am UTC](https://discuss.elastic.co/t/why-logstash-err-and-logstash-stdout-are-created-with-root-privileges/59890/3 "2016-09-08T08:39:00Z")

</div>

Thanks much for the clarifications 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/why-logstash-err-and-logstash-stdout-are-created-with-root-privileges/59890/4 "2017-07-06T04:39:19Z")

</div>