IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Grant privileges and roles needed for setup Grant privileges and roles needed for publishing »
Elastic Docs ›Filebeat Reference [7.8] ›Secure Filebeat ›Grant users access to secured resources

Grant privileges and roles needed for monitoring

edit

Grant privileges and roles needed for monitoring

edit

Elasticsearch security features provides built-in users and roles for monitoring. The privileges and roles needed depend on the method used to collect monitoring data.

Important note for Elastic Cloud users

Built-in users are not available when running our hosted Elasticsearch Service on Elastic Cloud. To send monitoring data securely, create a monitoring user and grant it the roles described in the following sections.

  • If you’re using internal collection to collect metrics about Filebeat, Elasticsearch security features provides the beats_system built-in user and beats_system built-in role to send monitoring information. You can use the built-in user, if it’s available in your environment, or create a user who has the privileges needed to send monitoring information.

    If you use the beats_system user, make sure you set the password.

    If you don’t use the beats_system user:

    1. Create a monitoring role, called something like filebeat_monitoring, that has the following privileges:

      Type Privilege Purpose

      Cluster

      monitor

      Retrieve cluster details (e.g. version)

      Index

      create_index on .monitoring-beats-* indices

      Create monitoring indices in Elasticsearch

      Index

      create_doc on .monitoring-beats-* indices

      Write monitoring events into Elasticsearch

    2. Assign the monitoring role, along with the following built-in roles, to users who need to monitor Filebeat:

      Role Purpose

      kibana_user

      Use Kibana

      monitoring_user

      Use Stack Monitoring in Kibana to monitor Filebeat

  • If you’re using Metricbeat to collect metrics about Filebeat, Elasticsearch security features provides the remote_monitoring_user built-in user, and the remote_monitoring_collector and remote_monitoring_agent built-in roles for collecting and sending monitoring information. You can use the built-in user, if it’s available in your environment, or create a user who has the privileges needed to collect and send monitoring information.

    If you use the remote_monitoring_user user, make sure you set the password.

    If you don’t use the remote_monitoring_user user:

    1. Create a user on the production cluster who will collect and send monitoring information.

    2. Assign the following roles to the user:

      Role Purpose

      remote_monitoring_collector

      Collect monitoring metrics from Filebeat

      remote_monitoring_agent

      Send monitoring data to the monitoring cluster

    3. Assign the following role to users who will view the monitoring data in Kibana:

      Role Purpose

      monitoring_user

      Use Stack Monitoring in Kibana to monitor Filebeat
« Grant privileges and roles needed for setup Grant privileges and roles needed for publishing »