- Winlogbeat Reference: other versions:
- Winlogbeat Overview
- Quick start: installation and configuration
- Set up and run
- Upgrade
- Configure
- Winlogbeat
- General settings
- Project paths
- Output
- Kerberos
- SSL
- Index lifecycle management (ILM)
- Elasticsearch index template
- Kibana endpoint
- Kibana dashboards
- Processors
- Define processors
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- append
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- rate_limit
- registered_domain
- rename
- replace
- script
- syslog
- timestamp
- translate_sid
- truncate_fields
- urldecode
- Internal queue
- Logging
- HTTP endpoint
- Instrumentation
- winlogbeat.reference.yml
- How to guides
- Modules
- Exported fields
- Monitor
- Secure
- Troubleshoot
- Get Help
- Debug
- Understand logged metrics
- Common problems
- Dashboard in Kibana is breaking up data fields incorrectly
- Bogus computer_name fields are reported in some events
- Error loading config file
- Found unexpected or unknown characters
- Logstash connection doesn’t work
- Publishing to Logstash fails with "connection reset by peer" message
- @metadata is missing in Logstash
- Not sure whether to use Logstash or Beats
- SSL client fails to connect to Logstash
- Monitoring UI shows fewer Beats than expected
- Dashboard could not locate the index-pattern
- High RSS memory usage due to MADV settings
- Not sure how to read from .evtx files
- Contribute to Beats
Grant privileges and roles needed for monitoring
editGrant privileges and roles needed for monitoring
editElasticsearch security features provides built-in users and roles for monitoring. The privileges and roles needed depend on the method used to collect monitoring data.
Important note for Elastic Cloud users
Built-in users are not available when running our hosted Elasticsearch Service on Elastic Cloud. To send monitoring data securely, create a monitoring user and grant it the roles described in the following sections.
-
If you’re using internal collection to collect metrics about Winlogbeat, Elasticsearch security features provides the
beats_system
built-in user andbeats_system
built-in role to send monitoring information. You can use the built-in user, if it’s available in your environment, or create a user who has the privileges needed to send monitoring information.If you use the
beats_system
user, make sure you set the password.If you don’t use the
beats_system
user:-
Create a monitoring role, called something like
winlogbeat_monitoring
, that has the following privileges:Type Privilege Purpose Cluster
monitor
Retrieve cluster details (e.g. version)
Index
create_index
on.monitoring-beats-*
indicesCreate monitoring indices in Elasticsearch
Index
create_doc
on.monitoring-beats-*
indicesWrite monitoring events into Elasticsearch
-
Assign the monitoring role, along with the following built-in roles, to users who need to monitor Winlogbeat:
Role Purpose kibana_admin
Use Kibana
monitoring_user
Use Stack Monitoring in Kibana to monitor Winlogbeat
-
-
If you’re using Metricbeat to collect metrics about Winlogbeat, Elasticsearch security features provides the
remote_monitoring_user
built-in user, and theremote_monitoring_collector
andremote_monitoring_agent
built-in roles for collecting and sending monitoring information. You can use the built-in user, if it’s available in your environment, or create a user who has the privileges needed to collect and send monitoring information.If you use the
remote_monitoring_user
user, make sure you set the password.If you don’t use the
remote_monitoring_user
user:- Create a user on the production cluster who will collect and send monitoring information.
-
Assign the following roles to the user:
Role Purpose remote_monitoring_collector
Collect monitoring metrics from Winlogbeat
remote_monitoring_agent
Send monitoring data to the monitoring cluster
-
Assign the following role to users who will view the monitoring data in Kibana:
Role Purpose monitoring_user
Use Stack Monitoring in Kibana to monitor Winlogbeat