This functionality is experimental and may be changed or removed completely in a future release. Elastic will take a best effort approach to fix any issues, but experimental features are not subject to the support SLA of official GA features.

« Grant privileges and roles needed for monitoring Grant privileges and roles needed to read Journalbeat data from Kibana »

› › ›

Grant privileges and roles needed for publishing

edit

Grant privileges and roles needed for publishing

edit

Users who publish events to Elasticsearch need to create and write to Journalbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.

When using ILM, turn off the ILM setup check in the Journalbeat config file before running Journalbeat to publish events:

setup.ilm.check_exists: false

To grant the required privileges:

Create a writer role, called something like journalbeat_writer, that has the following privileges:

The monitor cluster privilege and the create_doc privilege on journalbeat-* indices are required in every configuration.

Type	Privilege	Purpose
Cluster	`monitor`	Retrieve cluster details (e.g. version)
Cluster	`read_ilm`	Read the ILM policy when connecting to clusters that support ILM. Not needed when `setup.ilm.check_exists` is `false`.
Index	`create_doc` on `journalbeat-*` indices	Write events into Elasticsearch
Index	`view_index_metadata` on `journalbeat-*` indices	Check for alias when connecting to clusters that support ILM. Not needed when `setup.ilm.check_exists` is `false`.
Index	`create_index` on `journalbeat-*` indices	Create daily indices when connecting to clusters that do not support ILM. Not needed when using ILM.

Omit any privileges that aren’t relevant in your environment.

Assign the writer role to users who will index events into Elasticsearch.

« Grant privileges and roles needed for monitoring Grant privileges and roles needed to read Journalbeat data from Kibana »