New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Configure Filebeat to use X-Pack security Configure authentication credentials »
Elastic Docs ›Filebeat Reference [7.1] ›Securing Filebeat ›Configure Filebeat to use X-Pack security

Grant users access to secured resources

edit

Grant users access to secured resources

edit

You can use role-based access control to grant users access to secured resources. The roles that you set up depend on your organization’s security requirements and the minimum privileges required to use specific features.

Filebeat users typically perform these main roles: they do the initial setup, publish monitoring information, and publish events. If they’re using Kibana, they view and sometimes create visualizations that access Filebeat indices.

X-Pack security provides pre-built roles that grant some of the privileges needed by Filebeat users. When possible, use the built-in roles to minimize the affect of future changes on your security strategy.

For privileges not granted by existing roles, create new roles. At a minimum, create a role for setting up Filebeat, a role for publishing events, and a role for reading Filebeat indices. Assign these new roles, along with the pre-built roles, to grant the full set of privileges required by Filebeat users.

The following sections describe the privileges and roles required to perform specific job roles.

Privileges needed for initial setup

edit

Users who set up Filebeat typically need to load mappings, dashboards, and other objects used to index data into Elasticsearch and visualize it in Kibana. The privileges required depend on the setup tasks users need to perform.

These instructions assume that you are using the default name for Filebeat indices. If you are using a custom name, modify the privileges to match your index naming pattern.

Task Required privileges and roles

Set up index templates

manage_index_templates and monitor on cluster

manage_ilm on cluster (if cluster supports index lifecycle management)

manage on filebeat-* indices (if cluster supports index lifecycle management)

Set up example dashboards

kibana_user role

Set up machine learning job configurations

manage_ml and monitor on cluster

read on filebeat-* indices

kibana_user role

Set up ingest pipelines

monitor on cluster

ingest_admin role

Set up index lifecycle policies

manage_ilm, manage_index_templates, and monitor on cluster

manage on filebeat-* indices

Enroll and manage configurations in Beats central management

beats_admin and kibana_user roles

Privileges needed to publish and view monitoring information

edit

X-Pack security provides the filebeat_system built-in user and filebeat_system built-in role for sending monitoring information. You can use the built-in user, or create a user who has the privileges needed to send monitoring information. If you use the filebeat_system user, make sure you set the password.

Task Required privileges and roles

Send monitoring info

monitor on cluster

Use Stack Monitoring in Kibana to monitor Filebeat

monitoring_user and kibana_user roles

Privileges needed to publish events

edit

Users who publish events to Elasticsearch need to create and read from Filebeat indices. The privileges required for this role depend on the tasks users need to perform:

Task Required privileges and roles

Send data to a secured cluster without index lifecycle management

monitor on cluster (and manage_pipeline if Filebeat modules are used)

create_index and index on filebeat-* indices

also requires privileges to set up index templates unless you’ve disabled automatic template loading

Send data to a secured cluster that supports index lifecycle management

manage_index_templates,manage_ilm [1], and monitor on cluster (and manage_pipeline if Filebeat modules are used)

index and manage on filebeat-* indices

Read configurations from Beats central management

monitor on cluster

beats_admin role

Privileges needed by Kibana users

edit

Kibana users typically need to view dashboards and visualizations that contain Filebeat data. These users might also need to create and edit dashboards and visualizations. If you’re using Beats central management, they need to create and manage configurations.

The privileges required for Kibana users depend on the tasks they need to perform:

Task Required privileges and roles

View Filebeat dashboards

read on filebeat-* indices

kibana_dashboard_only_user role

View and edit Filebeat dashboards

read on filebeat-* indices

kibana_user role

Create and manage configurations in Beats central management

beats_admin role

kibana_user role

Learn more about users and roles

edit

Want to learn more about creating users and roles? See Securing the Elastic Stack. Also see:

[1] Use read_ilm instead of manage_ilm if you pre-loaded the lifecycle policy
« Configure Filebeat to use X-Pack security Configure authentication credentials »