title: logstash filebeat service account for centos 7
body: <p>I am trying to get filebeat (for logstash forwarding) on a CentOS 7 environment to run under my created user account: filebeat instead of root.  I tried editing the <code>/etc/rc.d/init.d/filebeat</code> file to the following but to no avail.  I might be doing something wrong but still a bit new to BASH scripting that I might be putting it in the wrong place?  I attempted to follow suggested implementation instructions located <a href="https://github.com/elastic/filebeat/issues/148" rel="nofollow">here</a></p>
  
  <p>For brevity, I am only showing the first part of the mentioned file as the latter parts are unchanged:</p>
  
  <pre><code>#!/bin/bash
  #
  # filebeat          filebeat shipper
  #
  # chkconfig: 2345 98 02
  #
  
  ### BEGIN INIT INFO
  # Provides:          filebeat
  # Required-Start:    $local_fs $network $syslog
  # Required-Stop:     $local_fs $network $syslog
  # Default-Start:     2 3 4 5
  # Default-Stop:      0 1 6
  # Short-Description: Sends log files to Logstash or directly to Elasticsearch.
  # Description:       filebeat is a shipper part of the Elastic Beats
  #                                        family. Please see: https://www.elastic.co/products/beats
  ### END INIT INFO
  
  
  
  PATH=/usr/bin:/sbin:/bin:/usr/sbin
  export PATH
  
  [ -f /etc/sysconfig/filebeat ] &amp;&amp; . /etc/sysconfig/filebeat
  pidfile=${PIDFILE-/var/run/filebeat.pid}
  agent=${PB_AGENT-/usr/bin/filebeat}
  args="-c /etc/filebeat/filebeat.yml"
  test_args="-e -configtest"
  wrapper="filebeat-god"
  wrapperopts="-r / -n -p $pidfile"
  RETVAL=0
  service_user="filebeat"
  # Source function library.
  . /etc/rc.d/init.d/functions
  
  # Determine if we can use the -p option to daemon, killproc, and status.
  # RHEL &lt; 5 can't.
  if status | grep -q -- '-p' 2&gt;/dev/null; then
      daemonopts="--user $service_user --group $service_group --pidfile $pidfile"
      **chown -R $service_user /etc/filebeat || return 1
      chown $service_user $pidfile || return 1
      chmod g+w $pidfile || return 1**
      pidopts="-p $pidfile"
      touch
  fi
  </code></pre>
  
  <p>Previously I created a user account filebeat using similar to the following:</p>
  
  <pre><code>useradd filebeat -u 5044 -c "Filebeat Service Account" -d /dev/null -s /sbin/nologin
  </code></pre>
  
  <p>However, when I try and take a look at the process after starting it still shows as being owned by root:</p>
  
  <pre><code>[root@testvm ~]# ps -aef | grep filebeat
  root     26030     1  0 13:16 ?        00:00:00 /usr/bin/filebeat -c /etc/filebeat/filebeat.yml
  </code></pre>