- Filebeat Reference: other versions:
- Overview
- Getting Started With Filebeat
- Step 1: Install Filebeat
- Step 2: Configure Filebeat
- Step 3: Configure Filebeat to use Logstash
- Step 4: Load the index template in Elasticsearch
- Step 5: Set up the Kibana dashboards
- Step 6: Start Filebeat
- Step 7: View the sample Kibana dashboards
- Quick start: modules for common log formats
- Repositories for APT and YUM
- Setting up and running Filebeat
- Upgrading Filebeat
- How Filebeat works
- Configuring Filebeat
- Specify which modules to run
- Configure inputs
- Manage multiline messages
- Specify general settings
- Load external configuration files
- Configure the internal queue
- Configure the output
- Load balance the output hosts
- Specify SSL settings
- Filter and enhance the exported data
- Parse data by using ingest node
- Set up project paths
- Set up the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- Autodiscover
- YAML tips and gotchas
- Regular expression support
- HTTP Endpoint
- filebeat.reference.yml
- Beats central management
- Modules
- Exported fields
- Apache2 fields
- Auditd fields
- Beat fields
- Cloud provider metadata fields
- Docker fields
- elasticsearch fields
- haproxy fields
- Host fields
- Icinga fields
- IIS fields
- Kafka fields
- kibana fields
- Kubernetes fields
- Log file content fields
- logstash fields
- mongodb fields
- MySQL fields
- Nginx fields
- Osquery fields
- PostgreSQL fields
- Redis fields
- System fields
- Traefik fields
- Monitoring Filebeat
- Securing Filebeat
- Troubleshooting
- Migrating from Logstash Forwarder to Filebeat
- Contributing to Beats
Grant users access to Filebeat indices
editGrant users access to Filebeat indices
editTo enable users to access the indices Filebeat creates, grant them read
and view_index_metadata
privileges on the Filebeat indices. If they’re
using Kibana, they also need the kibana_user
role.
-
Create a reader role that has the
read
andview_index_metadata
privileges on the Filebeat indices.You can create roles from the Management > Roles UI in Kibana or through the
role
API. For example, the following request creates a role namedfilebeat_reader
: -
Assign your users the reader role so they can access the Filebeat indices. For Kibana users who need to visualize the data, also assign the
kibana_user
role:-
If you’re using the
native
realm, you can assign roles with the Management > Users UI in Kibana or through theuser
API. For example, the following request grantsfilebeat_user
thefilebeat_reader
andkibana_user
roles:POST /_xpack/security/user/filebeat_user { "password" : "YOUR_PASSWORD", "roles" : [ "filebeat_reader","kibana_user"], "full_name" : "Filebeat User" }
-
If you’re using the LDAP, Active Directory, or PKI realms, you assign the roles in the
role_mapping.yml
configuration file. For example, the following snippet grantsFilebeat User
thefilebeat_reader
andkibana_user
roles:filebeat_reader: - "cn=Filebeat User,dc=example,dc=com" kibana_user: - "cn=Filebeat User,dc=example,dc=com"
For more information, see Using Role Mapping Files.
-