Built-in roles
editBuilt-in roles
editThe Elastic Stack security features apply a default role to all users, including anonymous users. The default role enables users to access the authenticate endpoint, change their own passwords, and get information about themselves.
There is also a set of built-in roles you can explicitly assign to users. These roles have a fixed set of privileges and cannot be updated.
-
apm_system
- Grants access necessary for the APM system user to send system-level data (such as monitoring) to Elasticsearch.
-
apm_user
-
Grants the privileges required for APM users (such as
read
andview_index_metadata
privileges on theapm-*
and.ml-anomalies*
indices). [7.13.0] Deprecated in 7.13.0. See APM app users and privileges for alternatives. . -
beats_admin
-
Grants access to the
.management-beats
index, which contains configuration information for the Beats. -
beats_system
-
Grants access necessary for the Beats system user to send system-level data (such as monitoring) to Elasticsearch.
- This role should not be assigned to users as the granted permissions may change between releases.
- This role does not provide access to the beats indices and is not suitable for writing beats output to Elasticsearch.
-
data_frame_transforms_admin
-
Grants
manage_data_frame_transforms
cluster privileges, which enable you to manage transforms. This role also includes all Kibana privileges for the machine learning features. [7.5.0] Deprecated in 7.5.0. Replaced bytransform_admin
. -
data_frame_transforms_user
-
Grants
monitor_data_frame_transforms
cluster privileges, which enable you to use transforms. This role also includes all Kibana privileges for the machine learning features. [7.5.0] Deprecated in 7.5.0. Replaced bytransform_user
. -
editor
-
[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Grants full access to all features in Kibana (including Solutions) and read-only access to data indices.
- This role provides read access to any index that is not prefixed with a dot.
- This role automatically grants full access to new Kibana features as soon as they are released.
-
enrich_user
-
Grants access to manage all enrich indices (
.enrich-*
) and all operations on ingest pipelines. -
ingest_admin
-
Grants access to manage all index templates and all ingest pipeline configurations.
This role does not provide the ability to create indices; those privileges must be defined in a separate role.
-
kibana_dashboard_only_user
- (This role is deprecated, please use Kibana feature privileges instead). Grants read-only access to the Kibana Dashboard in every space in Kibana. This role does not have access to editing tools in Kibana.
-
kibana_system
-
Grants access necessary for the Kibana system user to read from and write to the Kibana indices, manage index templates and tokens, and check the availability of the Elasticsearch cluster. This role grants read access to the
.monitoring-*
indices and read and write access to the.reporting-*
indices. For more information, see Configuring Security in Kibana.This role should not be assigned to users as the granted permissions may change between releases.
-
kibana_admin
- Grants access to all features in Kibana. For more information on Kibana authorization, see Kibana authorization.
-
kibana_user
-
(This role is deprecated, please use the
kibana_admin
role instead.) Grants access to all features in Kibana. For more information on Kibana authorization, see Kibana authorization. -
logstash_admin
-
Grants access to the
.logstash*
indices for managing configurations, and grants necessary access for logstash-specific APIs exposed by the logstash x-pack plugin. -
logstash_system
-
Grants access necessary for the Logstash system user to send system-level data (such as monitoring) to Elasticsearch. For more information, see Configuring Security in Logstash.
- This role should not be assigned to users as the granted permissions may change between releases.
- This role does not provide access to the logstash indices and is not suitable for use within a Logstash pipeline.
-
machine_learning_admin
-
Provides all of the privileges of the
machine_learning_user
role plus the full use of the machine learning APIs. Grantsmanage_ml
cluster privileges, read access to.ml-anomalies*
,.ml-notifications*
,.ml-state*
,.ml-meta*
indices and write access to.ml-annotations*
indices. Machine learning administrators also need index privileges for source and destination indices and roles that grant access to Kibana. See Machine learning security privileges. -
machine_learning_user
-
Grants the minimum privileges required to view machine learning configuration,
status, and work with results. This role grants
monitor_ml
cluster privileges, read access to the.ml-notifications
and.ml-anomalies*
indices (which store machine learning results), and write access to.ml-annotations*
indices. Machine learning users also need index privileges for source and destination indices and roles that grant access to Kibana. See Machine learning security privileges. -
monitoring_user
-
Grants the minimum privileges required for any user of X-Pack monitoring other than those
required to use Kibana. This role grants access to the monitoring indices and grants
privileges necessary for reading basic cluster information. This role also includes
all Kibana privileges for the Elastic Stack monitoring features.
Monitoring users should also be assigned the
kibana_admin
role, or another role with access to the Kibana instance. -
remote_monitoring_agent
-
Grants the minimum privileges required to write data into the monitoring indices
(
.monitoring-*
). This role also has the privileges necessary to create Metricbeat indices (metricbeat-*
) and write data into them. -
remote_monitoring_collector
- Grants the minimum privileges required to collect monitoring data for the Elastic Stack.
-
reporting_user
- Grants the specific privileges required for users of X-Pack reporting other than those required to use Kibana. This role grants access to the reporting indices; each user has access to only their own reports. Reporting users should also be assigned additional roles that grant access to Kibana as well as read access to the indices that will be used to generate reports.
-
snapshot_user
- Grants the necessary privileges to create snapshots of all the indices and to view their metadata. This role enables users to view the configuration of existing snapshot repositories and snapshot details. It does not grant authority to remove or add repositories or to restore snapshots. It also does not enable to change index settings or to read or update data stream or index data.
-
superuser
-
Grants full access to the cluster, including all indices and data. A user with
the
superuser
role can also manage users and roles and impersonate any other user in the system. Due to the permissive nature of this role, take extra care when assigning it to a user. -
transform_admin
-
Grants
manage_transform
cluster privileges, which enable you to manage transforms. This role also includes all Kibana privileges for the machine learning features. -
transform_user
-
Grants
monitor_transform
cluster privileges, which enable you to use transforms. This role also includes all Kibana privileges for the machine learning features. -
transport_client
-
Grants the privileges required to access the cluster through the Java Transport Client. The Java Transport Client fetches information about the nodes in the cluster using the Node Liveness API and the Cluster State API (when sniffing is enabled). Assign your users this role if they use the Transport Client.
Using the Transport Client effectively means the users are granted access to the cluster state. This means users can view the metadata over all indices, index templates, mappings, node and basically everything about the cluster. However, this role does not grant permission to view the data in all indices.
-
viewer
-
[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Grants read-only access to all features in Kibana (including Solutions) and to data indices.
- This role provides read access to any index that is not prefixed with a dot.
- This role automatically grants read-only access to new Kibana features as soon as they are available.
-
watcher_admin
-
Allows users to create and execute all Watcher actions. Grants read access to the
.watches
index. Also grants read access to the watch history and the triggered watches index. -
watcher_user
-
Grants read access to the
.watches
index, the get watch action and the watcher stats.