I recently set up Logstash with Kibana and Elasticsearch, but am having a problem whereby it's not reading logs unless the directory permissions are world read/execute (and the files at least world read).
I've installed version 1.4.2 from the RPM, which runs as the logstash user. I've made sure the logstash user is a member of the groups relating to logs it needs to read, e.g. "apache".
[root@rhel-00081 conf]# id logstash uid=497(logstash) gid=497(logstash) groups=48(apache),10081(nexus),27666(spark),497(logstash)
The default permission on /var/log/http is
drwxr-x--- root apache, yet Logstash will not process the logs until I change this to
Any idea why this is?