Grant privileges and roles needed for publishing
Users who publish events to Elasticsearch need to create and write to Filebeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.
When using ILM, turn off the ILM setup check in the Filebeat config file before running Filebeat to publish events:
setup.ilm.check_exists: false
To grant the required privileges:
Create a writer role, called something like
filebeat_writer
, that has the following privileges:NoteThe
monitor
cluster privilege and thecreate_doc
andauto_configure
privileges onfilebeat-*
indices are required in every configuration.Type Privilege Purpose Cluster monitor
Retrieve cluster details (e.g. version) Cluster read_ilm
Read the ILM policy when connecting to clusters that support ILM.Not needed when setup.ilm.check_exists
isfalse
.Cluster read_pipeline
Check for ingest pipelines used by modules. Needed when using modules. Index create_doc
onfilebeat-*
indicesWrite events into Elasticsearch Index auto_configure
onfilebeat-*
indicesUpdate the datastream mapping. Consider either disabling entirely or adding therule -{{beat_default_index_prefix}}-*
to the cluster settingsaction.auto_create_indexto prevent unwanted indices creations from the agents.Omit any privileges that aren’t relevant in your environment.
Assign the writer role to users who will index events into Elasticsearch.