New

The executive guide to generative AI

Read more
About usPartnersSupport|Login
IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Grant users access to secured resources Configure authentication credentials »
Elastic Docs ›Filebeat Reference [7.6] ›Secure Filebeat ›Configure Filebeat to use security features

Grant access using API keys

edit

Grant access using API keys

edit

Instead of using usernames and passwords, you can use API keys to grant access to Elasticsearch resources. You can set API keys to expire at a certain time, and you can explicitly invalidate them. Any user with the manage_api_key or manage_own_api_key cluster privilege can create API keys.

See the Elasticsearch API key documentation for more information:

Filebeat instances typically send both collected data and monitoring information to Elasticsearch. If you are sending both to the same cluster, you can use the same API key. For different clusters, you need to use an API key per cluster.

For security reasons, we recommend using a unique API key per Beat instance. You can create as many API keys per user as necessary.

Create an API key for publishing

edit

To create an API key to use for writing data to Elasticsearch, use the Create API key API, for example:

POST /_security/api_key
{
  "name": "filebeat_host001", 
  "role_descriptors": {
    "filebeat_writer": { 
      "cluster": ["monitor", "read_ilm"],
      "index": [
        {
          "names": ["filebeat-*"],
          "privileges": ["view_index_metadata", "create_doc"]
        }
      ]
    }
  }
}
Copy as curlTry in Elastic 

Name of the API key

Granted privileges, see Grant users access to secured resources

The return value will look something like this:

{
  "id":"TiNAGG4BaaMdaH1tRfuU", 
  "name":"filebeat_host001",
  "api_key":"KnR6yE41RrSowb0kQ0HWoA" 
}

Unique id for this API key

Generated API key

You can now use this API key in your filebeat.yml configuration file like this:

output.elasticsearch:
  api_key: TiNAGG4BaaMdaH1tRfuU:KnR6yE41RrSowb0kQ0HWoA

Format is id:api_key (as returned by Create API key)

Create an API key for monitoring

edit

To create an API key to use for sending monitoring data to Elasticsearch, use the Create API key API, for example:

POST /_security/api_key
{
  "name": "filebeat_host001", 
  "role_descriptors": {
    "filebeat_monitoring": { 
      "cluster": ["monitor"],
      "index": [
        {
          "names": [".monitoring-beats-*"],
          "privileges": ["create_index", "create"]
        }
      ]
    }
  }
}
Copy as curlTry in Elastic 

Name of the API key

Granted privileges, see Grant users access to secured resources

The return value will look something like this:

{
  "id":"TiNAGG4BaaMdaH1tRfuU", 
  "name":"filebeat_host001",
  "api_key":"KnR6yE41RrSowb0kQ0HWoA" 
}

Unique id for this API key

Generated API key

You can now use this API key in your filebeat.yml configuration file like this:

monitoring.elasticsearch:
  api_key: TiNAGG4BaaMdaH1tRfuU:KnR6yE41RrSowb0kQ0HWoA

Format is id:api_key (as returned by Create API key)
« Grant users access to secured resources Configure authentication credentials »

On this page

Was this helpful?
Feedback