#logstash

hey guys

we've just been trying logstash 5.4.3 and it seems infinite slower to process messages than with our "old" (current) logstash (1.5.x) version ... has anyone had similar experience ? what did you do to "fix" it ?

s/messages/events/ ;)

i know it's a little vague... but the setup is actually quite simple ... logstash-shipper (still 1.5.x) (lumberjack output) -> (lumberjack-input) logstash-indexer 5.4.3 (elasticsearch-output) -> ES

Hi I have a new Logstash install from .deb on Ubuntu 16, trying to read FreeRADIUS log but getting permission denied. I tried adding logstash user to freerad group but still permission denied. What's the recommended way to allow access? I tried setting LS_USER='root' in /etc/default/logstash and /etc/logstash/startup.options but still it can't read it

When I start logstash manually (./bin/logstash --path /etc/logstash) then it works fine, but not when starting from 'service logstash start'

ambrose: if you installed logstash from a deb it should be trying to run as the logstash user

if you've started it as root from the cmdline then you've probably messed up permissions somewhere

most likely a log file

s/permissions/ownership

I wouldn't recommend starting the service as root at any rate

it's fine how it is

BaM`: how to fix this? https://paste.ubuntu.com/25014720/

what's the group ownership of that file?

Freeradius creates new files daily with permissions -rw------- 1 freerad freerad

usermod -a -G logstash freerad

uh, except that file mode is 600

BaM`: ok thx just ran that

so that won't help

oh ok

the file needs to be at least 640 for that to work

The files are created that way by freeradius?

freeradius might have an option to set the mode on write

also, if it's writing a new file every day, logstash is going to end up with a massive sincedb file after a while

because it's going to record its place in every file it comes across

ok?

it's a problem?

it could be

I don't have any experience with that exact case, because none of our log files are written like that - with the date in the name

but logstash is going to record it's place in the file, and then never use that info again

but start a new sincedb entry for the next day's log file

Well it wont be a problem if I can't get Logstash to read the file :p

so every day the sincedb file gets bigger instead of just being modified

you can try doing setgid on the log file directory