New

The executive guide to generative AI

Read more
About usPartnersSupport|Login

WARNING: Version 6.2 of Packetbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Packetbeat and X-Pack Security Granting Users Access to Packetbeat Indices »
Elastic Docs ›Packetbeat Reference [6.2] ›Securing Packetbeat ›Packetbeat and X-Pack Security

Configuring Authentication Credentials for Packetbeat

edit

Configuring Authentication Credentials for Packetbeat

edit

When sending data to a secured cluster through the elasticsearch output, Packetbeat must either provide basic authentication credentials or present a client certificate.

To configure authentication credentials for Packetbeat:

  1. Create a role that has the manage_index_templates and monitor cluster privileges, and read, write, and create_index privileges for the indices that Packetbeat creates. You can create roles from the Management / Roles UI in Kibana or through the role API. For example, the following request creates a packetbeat_writer role:

    POST _xpack/security/role/packetbeat_writer
{
  "cluster": ["manage_index_templates", "monitor"],
  "indices": [
    {
      "names": [ "packetbeat-*" ], 
      "privileges": ["write","create_index"]
    }
  ]
}

    If you use a custom Packetbeat index pattern, specify that pattern instead of the default packetbeat-* pattern.

  2. Assign the writer role to the user that Packetbeat will use to connect to Elasticsearch:

    1. To authenticate as a native user, create a user for the Packetbeat to use internally and assign it the writer role. You can create users from the Management / Users UI in Kibana or through the user API. For example, the following request creates a packetbeat_internal user that has the packetbeat_writer role:

      POST /_xpack/security/user/packetbeat_internal
{
  "password" : "x-pack-test-password",
  "roles" : [ "packetbeat_writer"],
  "full_name" : "Internal Packetbeat User"
}

    2. To authenticate using PKI authentication, assign the writer role to the internal Packetbeat user in the role_mapping.yml configuration file. Specify the user by the distinguished name that appears in its certificate.

      packetbeat_writer:
  - "cn=Internal Packetbeat User,ou=example,o=com"

      For more information, see Using Role Mapping Files.

  3. Configure authentication credentials for the elasticsearch output in the Packetbeat configuration file:

    1. To use basic authentication, configure the username and password settings. For example, the following Packetbeat output configuration uses the native packetbeat_internal user to connect to Elasticsearch:

      output.elasticsearch:
    hosts: ["localhost:9200"]
    index: "packetbeat"
    username: "packetbeat_internal"
    password: "x-pack-test-password"

    2. To use PKI authentication, configure the certificate and key settings:

      output.elasticsearch:
    hosts: ["localhost:9200"]
    index: "packetbeat"
    ssl.certificate: "/etc/pki/client/cert.pem" 
    ssl.key: "/etc/pki/client/cert.key"

      The distinguished name (DN) in the certificate must be mapped to the writer role in the role_mapping.yml configuration file on each node in the Elasticsearch cluster.
« Packetbeat and X-Pack Security Granting Users Access to Packetbeat Indices »
Was this helpful?
Feedback