IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Grant privileges and roles needed for monitoring Grant privileges and roles needed to read Winlogbeat data from Kibana »
Elastic Docs ›Winlogbeat Reference [8.14] ›Secure Winlogbeat ›Grant users access to secured resources

Grant privileges and roles needed for publishing

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Grant privileges and roles needed for publishing

edit

Users who publish events to Elasticsearch need to create and write to Winlogbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.

When using ILM, turn off the ILM setup check in the Winlogbeat config file before running Winlogbeat to publish events:

setup.ilm.check_exists: false

To grant the required privileges:

  1. Create a writer role, called something like winlogbeat_writer, that has the following privileges:

    The monitor cluster privilege and the create_doc and auto_configure privileges on winlogbeat-* indices are required in every configuration.

    Type Privilege Purpose

    Cluster

    monitor

    Retrieve cluster details (e.g. version)

    Cluster

    read_ilm

    Read the ILM policy when connecting to clusters that support ILM. Not needed when setup.ilm.check_exists is false.

    Cluster

    read_pipeline

    Check for ingest pipelines used by Winlogbeat.

    Index

    create_doc on winlogbeat-* indices

    Write events into Elasticsearch

    Index

    auto_configure on winlogbeat-* indices

    Update the datastream mapping. Consider either disabling entirely or adding the rule winlogbeat-* to the cluster settings action.auto_create_index to prevent unwanted indices creations from the agents.

    Omit any privileges that aren’t relevant in your environment.

  2. Assign the writer role to users who will index events into Elasticsearch.
« Grant privileges and roles needed for monitoring Grant privileges and roles needed to read Winlogbeat data from Kibana »