Cannot read any logs - Debian initscript does not chroot correctly (file input)

Hi,

when using the file input, logs have (duh) to be readable by the logstash user. Because I didn't want to start changing all my permissions on logs to root:logstash (and have to change manually all the logrotate scripts) I figured that

usermod -aG $GROUP logstash

repeated for every $GROUP I needed to give access to logs was enough.

Well, it wasn't.

After a few days fighting a massive headache, I figured out why this didn't work via the initscript, but I was perfectly able to read logs when launching logstash manually (even after "su logstash").
Thanks to this person, who had the same problem

http://serverfault.com/questions/632079/logstash-not-reading-logs-unless-world-readable

I realised that "chroot --userspec $LS_USER:$LS_GROUP" does not inherit the groups of the $LS_USER, but only gets $LS_GROUP

By modifying the initscript as suggested in the post above now chroot also receives --groups (only if the groups are more than just "logstash" and they are not in a weird order).

I don't know if there's a better way of doing this (by using "su" instead of "chroot"?), but it might be worth taking a look, because the logs do not report "access denied" or "unable to read $FILE"; it just does not work.

Thanks,

Claudio