WARNING: Version 6.0 of Winlogbeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Configuring Authentication Credentials for Winlogbeat Configuring Winlogbeat to use Encrypted Connections »

› › ›

Granting Users Access to Winlogbeat Indices

edit

Granting Users Access to Winlogbeat Indices

edit

To enable users to access the indices a Winlogbeat creates, grant them read and view_index_metadata privileges on the Winlogbeat indices:

Create a role that has the read and view_index_metadata privileges for the Winlogbeat indices. You can create roles from the Management > Roles UI in Kibana or through the role API. For example, the following request creates a winlogbeat_reader role:
```
POST _xpack/security/role/winlogbeat_reader
{
  "indices": [
    {
      "names": [ "winlogbeat-*" ], 
      "privileges": ["read","view_index_metadata"]
    }
  ]
}
```
If you use a custom Winlogbeat index pattern, specify that pattern instead of the default winlogbeat-* pattern.
Assign your users the reader role so they can access the Winlogbeat indices:
1. If you’re using the native realm, you can assign roles with the Management > Users UI in Kibana or through the user API. For example, the following request grants winlogbeat_user the winlogbeat_reader role:
```
POST /_xpack/security/user/winlogbeat_user
{
  "password" : "x-pack-test-password",
  "roles" : [ "winlogbeat_reader"],
  "full_name" : "Winlogbeat User"
}
```
2. If you’re using the LDAP, Active Directory, or PKI realms, you assign the roles in the role_mapping.yml configuration file. For example, the following snippet grants Winlogbeat User the winlogbeat_reader role:
```
winlogbeat_reader:
  - "cn=Winlogbeat User,dc=example,dc=com"
```
  For more information, see Using Role Mapping Files.

« Configuring Authentication Credentials for Winlogbeat Configuring Winlogbeat to use Encrypted Connections »