WARNING: Version 6.1 of Packetbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Configuring Authentication Credentials for Packetbeat
editConfiguring Authentication Credentials for Packetbeat
editWhen sending data to a secured cluster through the elasticsearch
output, Packetbeat must either provide basic authentication credentials
or present a client certificate.
To configure authentication credentials for Packetbeat:
-
Create a role that has the
manage_index_templates
andmonitor
cluster privileges, andread
,write
, andcreate_index
privileges for the indices that Packetbeat creates. You can create roles from the Management / Roles UI in Kibana or through therole
API. For example, the following request creates apacketbeat_writer
role: -
Assign the writer role to the user that Packetbeat will use to connect to Elasticsearch:
-
To authenticate as a native user, create a user for the Packetbeat to use internally and assign it the writer role. You can create users from the Management / Users UI in Kibana or through the
user
API. For example, the following request creates apacketbeat_internal
user that has thepacketbeat_writer
role:POST /_xpack/security/user/packetbeat_internal { "password" : "x-pack-test-password", "roles" : [ "packetbeat_writer"], "full_name" : "Internal Packetbeat User" }
-
To authenticate using PKI authentication, assign the writer role to the internal Packetbeat user in the
role_mapping.yml
configuration file. Specify the user by the distinguished name that appears in its certificate.packetbeat_writer: - "cn=Internal Packetbeat User,ou=example,o=com"
For more information, see Using Role Mapping Files.
-
-
Configure authentication credentials for the
elasticsearch
output in the Packetbeat configuration file:-
To use basic authentication, configure the
username
andpassword
settings. For example, the following Packetbeat output configuration uses the nativepacketbeat_internal
user to connect to Elasticsearch:output.elasticsearch: hosts: ["localhost:9200"] index: "packetbeat" username: "packetbeat_internal" password: "x-pack-test-password"
-
To use PKI authentication, configure the
certificate
andkey
settings:
-