- Functionbeat Reference:
- Functionbeat overview
- Quick start: installation and configuration
- Set up and deploy
- Configure
- AWS functions
- General settings
- Output
- Kerberos
- SSL
- Index lifecycle management (ILM)
- Elasticsearch index template
- Processors
- Define processors
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_tags
- append
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- rate_limit
- registered_domain
- rename
- replace
- syslog
- translate_sid
- truncate_fields
- urldecode
- Internal queue
- Logging
- Regular expression support
- Instrumentation
- functionbeat.reference.yml
- How to guides
- Exported fields
- Monitor
- Secure
- Troubleshoot
- Get help
- Debug
- Understand logged metrics
- Common problems
- Deployment to AWS fails with "failed to create the stack"
- Deployment to AWS fails with "resource limit exceeded"
- Error loading config file
- Found unexpected or unknown characters
- Logstash connection doesn’t work
- Publishing to Logstash fails with "connection reset by peer" message
- @metadata is missing in Logstash
- Not sure whether to use Logstash or Beats
- SSL client fails to connect to Logstash
- Monitoring UI shows fewer Beats than expected
- High RSS memory usage due to MADV settings
Grant privileges and roles needed for publishing
editGrant privileges and roles needed for publishing
editUsers who publish events to Elasticsearch need to create and write to Functionbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.
When using ILM, turn off the ILM setup check in the Functionbeat config file before running Functionbeat to publish events:
setup.ilm.check_exists: false
To grant the required privileges:
-
Create a writer role, called something like
functionbeat_writer
, that has the following privileges:The
monitor
cluster privilege and thecreate_doc
andauto_configure
privileges onfunctionbeat-*
indices are required in every configuration.Type Privilege Purpose Cluster
monitor
Retrieve cluster details (e.g. version)
Cluster
read_ilm
Read the ILM policy when connecting to clusters that support ILM. Not needed when
setup.ilm.check_exists
isfalse
.Index
create_doc
onfunctionbeat-*
indicesWrite events into Elasticsearch
Index
auto_configure
onfunctionbeat-*
indicesUpdate the datastream mapping. Consider either disabling entirely or adding the rule
-{beat_default_index_prefix}-*
to the cluster settings action.auto_create_index to prevent unwanted indices creations from the agents.Omit any privileges that aren’t relevant in your environment.
- Assign the writer role to users who will index events into Elasticsearch.
ElasticON events are back!
Learn about the Elastic Search AI Platform from the experts at our live events.
Register now