Grant privileges and roles needed for publishing

edit

Users who publish events to Elasticsearch need to create and write to Heartbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve pre-loaded dependencies.

When using ILM, turn off the ILM setup check in the Heartbeat config file before running Heartbeat to publish events:

setup.ilm.check_exists: false

To grant the required privileges:

  1. Create a writer role, called something like heartbeat_writer, that has the following privileges:

    The monitor cluster privilege and the create_doc privilege on heartbeat-* indices are required in every configuration.

    Type Privilege Purpose

    Cluster

    monitor

    Retrieve cluster details (e.g. version)

    Cluster

    read_ilm

    Read the ILM policy when connecting to clusters that support ILM. Not needed when setup.ilm.check_exists is false.

    Index

    create_doc on heartbeat-* indices

    Write events into Elasticsearch

    Index

    view_index_metadata on heartbeat-* indices

    Check for alias when connecting to clusters that support ILM. Not needed when setup.ilm.check_exists is false.

    Index

    create_index on heartbeat-* indices

    Create daily indices when connecting to clusters that do not support ILM. Not needed when using ILM.

    Omit any privileges that aren’t relevant in your environment.

  2. Assign the writer role to users who will index events into Elasticsearch.