{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/logstash/issues/3186","labels_url":"https://api.github.com/repos/elastic/logstash/issues/3186/labels{/name}","comments_url":"https://api.github.com/repos/elastic/logstash/issues/3186/comments","events_url":"https://api.github.com/repos/elastic/logstash/issues/3186/events","html_url":"https://github.com/elastic/logstash/issues/3186","id":73845317,"number":3186,"title":"Permissions denied /var/lib/logstash/.sincedb_*","user":{"login":"djob","id":818443,"avatar_url":"https://avatars.githubusercontent.com/u/818443?v=3","gravatar_id":"","url":"https://api.github.com/users/djob","html_url":"https://github.com/djob","followers_url":"https://api.github.com/users/djob/followers","following_url":"https://api.github.com/users/djob/following{/other_user}","gists_url":"https://api.github.com/users/djob/gists{/gist_id}","starred_url":"https://api.github.com/users/djob/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/djob/subscriptions","organizations_url":"https://api.github.com/users/djob/orgs","repos_url":"https://api.github.com/users/djob/repos","events_url":"https://api.github.com/users/djob/events{/privacy}","received_events_url":"https://api.github.com/users/djob/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-07T05:09:14Z","updated_at":"2015-05-12T13:34:20Z","closed_at":null,"body":"Hi,\r\n\r\ni'm trying to install and test logstash/elasticsearch/kibana, but i'm stuck with this error in /var/log/logstash/logstash.log\r\n\r\nI've checked permisions for that folder, and seems to be fine: logstash:logstash 775\r\n```\r\n{:timestamp=>\"2015-05-07T06:47:10.346000+0200\", :message=>\"SIGTERM received. Shutting down the pipeline.\", :level=>:warn}\r\n{:timestamp=>\"2015-05-07T06:47:10.352000+0200\", :message=>\"_sincedb_write rename/sync failed: /var/lib/logstash/.sincedb_797dd3e863d00f2efaeaf7cdff671371.new -> /var/lib/logstash/.sincedb_797dd3e863d00f2efaeaf7cdff671371: Permission denied - /var/lib/logstash/.sincedb_797dd3e863d00f2efaeaf7cdff671371.new or /var/lib/logstash/.sincedb_797dd3e863d00f2efaeaf7cdff671371\", :level=>:warn}\r\n```\r\n\r\nWhat i'm trying to do is connect logstash with nginx access (and error) logs.\r\n\r\n/etc/logstash/conf.d/nginx.conf\r\n\r\n```\r\ninput {\r\n  file {\r\n    path => \"/var/log/nginx/access.log\"\r\n  }\r\n}\r\n\r\nfilter {\r\n  mutate { replace => { \"type\" => \"nginx_access\" } }\r\n  grok {\r\n    match => { \"message\" => \"%{NGINXACCESS}\" }\r\n  }\r\n  date {\r\n    match => [ \"timestamp\" , \"dd/MMM/YYYY:HH:mm:ss Z\" ]\r\n  }\r\n  geoip {\r\n    source => \"clientip\"\r\n  }\r\n}\r\n\r\noutput {\r\n  elasticsearch {\r\n    host => \"localhost\"\r\n    protocol => \"http\"\r\n  }\r\n  stdout { codec => rubydebug }\r\n}\r\n```\r\n\r\nFile: /opt/logstash/patterns/nginx \r\n\r\n```\r\nNGUSERNAME [a-zA-Z\\.\\@\\-\\+_%]+\r\nNGUSER %{NGUSERNAME}\r\nNGINXACCESS %{IPORHOST:clientip} %{NGUSER:ident} %{NGUSER:auth} \\[%{HTTPDATE:timestamp}\\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) (?:\"(?:%{URI:referrer}|-)\"|%{QS:referrer}) %{QS:agent}\r\n\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/logstash/issues/comments/101279865","html_url":"https://github.com/elastic/logstash/issues/3186#issuecomment-101279865","issue_url":"https://api.github.com/repos/elastic/logstash/issues/3186","id":101279865,"user":{"login":"jsvd","id":31809,"avatar_url":"https://avatars.githubusercontent.com/u/31809?v=3","gravatar_id":"","url":"https://api.github.com/users/jsvd","html_url":"https://github.com/jsvd","followers_url":"https://api.github.com/users/jsvd/followers","following_url":"https://api.github.com/users/jsvd/following{/other_user}","gists_url":"https://api.github.com/users/jsvd/gists{/gist_id}","starred_url":"https://api.github.com/users/jsvd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsvd/subscriptions","organizations_url":"https://api.github.com/users/jsvd/orgs","repos_url":"https://api.github.com/users/jsvd/repos","events_url":"https://api.github.com/users/jsvd/events{/privacy}","received_events_url":"https://api.github.com/users/jsvd/received_events","type":"User","site_admin":false},"created_at":"2015-05-12T13:34:20Z","updated_at":"2015-05-12T13:34:20Z","body":"@djob there seems to be a thread on that issue in kibana https://github.com/elastic/kibana/issues/1950\r\ncan you see if the suggestions help you?"}}