This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Grant privileges and roles needed for monitoring Grant privileges and roles needed to read Packetbeat data from Kibana »

› › ›

Grant privileges and roles needed for publishing

edit

Grant privileges and roles needed for publishing

edit

Users who publish events to Elasticsearch need to create and write to Packetbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.

When using index lifecycle management (ILM), turn off the ILM setup check in the Packetbeat config file before running Packetbeat to publish events:

setup.ilm.check_exists: false

To grant the required privileges:

Create a writer role, called something like packetbeat_writer, that has the following privileges:

The monitor cluster privilege and the create_doc and auto_configure privileges on packetbeat-* indices are required in every configuration.

Type	Privilege	Purpose
Cluster	`monitor`	Retrieve cluster details (e.g. version)
Cluster	`read_ilm`	Read the ILM policy when connecting to clusters that support ILM. Not needed when `setup.ilm.check_exists` is `false`.
Index	`create_doc` on `packetbeat-*` indices	Write events into Elasticsearch
Index	`auto_configure` on `packetbeat-*` indices	Update the datastream mapping. Consider either disabling entirely or adding the rule `-{beat_default_index_prefix}-*` to the cluster settings action.auto_create_index to prevent unwanted indices creations from the agents.

Omit any privileges that aren’t relevant in your environment.

Assign the writer role to users who will index events into Elasticsearch.

« Grant privileges and roles needed for monitoring Grant privileges and roles needed to read Packetbeat data from Kibana »