Logstash can't access logs if all users don't have write permissions on it

Question

I am running logstash using docker and mounting a directory containing multiple log files but I have no output and the only solution is to give write permissions to all users on the directory containing log files.

I can't understand why I see no logs when all users doesn't have write permissions on this folder and I tried to change the owner and group to be "logstash" but it has no effect...

Do you have any idea why this is happening ? Thanks

PS : I have no error displayed in logstash docker logs

Answer 1

I am answering my own question if this can help someone.

I found a solution which is to give the permissions to the group "adm" on my folders and log files and to modify the groups of the container user ("logstash" so that they belong to the group "adm".

To do this I just added the "user" line in my docker-compose.yml :

opensearch-logstash:
    image: opensearchproject/logstash-oss-with-opensearch-output-plugin:7.16.2
    user: "1000:4" #user 1000 is logstash and group 4 is adm

Answer 2

You are mixing Linux style / and Windows style \\ path separators. The easiest way is to use

import os
...
file = os.path.join(path,a)

which should insert the right character for you, I assume it needs to be a '/' .