Grant access using API keys

Instead of using usernames and passwords, you can use API keys to grant access to Elasticsearch resources. You can set API keys to expire at a certain time, and you can explicitly invalidate them. Any user with the manage_api_key or manage_own_api_key cluster privilege can create API keys.

Auditbeat instances typically send both collected data and monitoring information to Elasticsearch. If you are sending both to the same cluster, you can use the same API key. For different clusters, you need to use an API key per cluster.

To create an API key to use for writing data to Elasticsearch, use the Create API key API, for example:

POST /_security/api_key
{
  "name": "auditbeat_host001", 
  "role_descriptors": {
    "auditbeat_writer": { 
      "cluster": ["monitor", "read_ilm", "read_pipeline"],
      "index": [
        {
          "names": ["auditbeat-*"],
          "privileges": ["view_index_metadata", "create_doc"]
        }
      ]
    }
  }
}

The return value will look something like this:

{
  "id":"TiNAGG4BaaMdaH1tRfuU", 
  "name":"auditbeat_host001",
  "api_key":"KnR6yE41RrSowb0kQ0HWoA" 
}

You can now use this API key in your auditbeat.yml configuration file like this:

output.elasticsearch:
  api_key: TiNAGG4BaaMdaH1tRfuU:KnR6yE41RrSowb0kQ0HWoA 

To create an API key to use for sending monitoring data to Elasticsearch, use the Create API key API, for example:

POST /_security/api_key
{
  "name": "auditbeat_host001", 
  "role_descriptors": {
    "auditbeat_monitoring": { 
      "cluster": ["monitor"],
      "index": [
        {
          "names": [".monitoring-beats-*"],
          "privileges": ["create_index", "create"]
        }
      ]
    }
  }
}

The return value will look something like this:

{
  "id":"TiNAGG4BaaMdaH1tRfuU", 
  "name":"auditbeat_host001",
  "api_key":"KnR6yE41RrSowb0kQ0HWoA" 
}

You can now use this API key in your auditbeat.yml configuration file like this:

monitoring.elasticsearch:
  api_key: TiNAGG4BaaMdaH1tRfuU:KnR6yE41RrSowb0kQ0HWoA 

See the Elasticsearch API key documentation for more information: