[root@default-centos-7 ~]# ls -al /var/log/messages
-rw-------. 1 root root 397726 Jan 20 19:19 /var/log/messages

[root@default-centos-7 ~]# getfacl /var/log/messages
getfacl: Removing leading '/' from absolute path names
# file: var/log/messages
# owner: root
# group: root
user::rw-
group::---
other::---

[root@default-centos-7 ~]# setfacl -m "u:logstash:r" /var/log/messages

[root@default-centos-7 ~]# ls -al /var/log/messages
-rw-r-----+ 1 root root 397726 Jan 20 19:19 /var/log/messages

[root@default-centos-7 ~]# getfacl /var/log/messages
getfacl: Removing leading '/' from absolute path names
# file: var/log/messages
# owner: root
# group: root
user::rw-
user:logstash:r--
group::---
mask::r--
other::---