search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
12.14k stars 4.91k forks source link

Filebeat Quickstart Permissions Issue #34569

Closed RemoteSalad closed 1 month ago

RemoteSalad commented 1 year ago

Describe the enhancement:

Expand documentation to advise or direct a solution for filebeat being unable to access its configs

Describe a specific use case for the enhancement or feature:

I am new to the ELK stack and trying different features. When trying run filebeat on an Ubuntu Server vm, at this point of the filebeat quickstart documentation there is an issue where filebeat cannot access its configurations. I'll note that I used the Debian installation method.

$ filebeat modules list Error initializing beat: error loading config file: open /etc/filebeat/filebeat.yml: permission denied

There is a workaround to disable strict permission checks in your documentation that you advise against. Further, that page expects there to be a filebeat user but after following the quickstart instructions there is no such user I can elevate.

I don't expect help here, but the documentation should clarify:

  1. Whether Linux users are expected to always run filebeat with sudo or the way to enhance filebeat's permissions.
  2. Best practices are for having filebeat function while still keeping a level of security.
botelastic[bot] commented 1 year ago

This issue doesn't have a Team:<team> label.

botelastic[bot] commented 7 months ago

Hi! We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!