Elastic Docs ›Elastic Observability [8.13] ›Application performance monitoring (APM) ›Secure communication with the Elastic Stack ›Secure communication with the Elastic Stack
« Secure communication with the Elastic Stack Grant privileges and roles needed for monitoring »

Grant privileges and roles needed for writing eventsedit

APM users that publish events to Elasticsearch need privileges to write to APM data streams.

General writer roleedit

To grant an APM user the required privileges for writing events to Elasticsearch:

  1. Create a general writer role, called something like apm_writer, that has the following privileges:

    Type Privilege Purpose

    Index

    auto_configure on traces-apm*, logs-apm*, and metrics-apm* indices

    Permits auto-creation of indices and data streams

    Index

    create_doc on traces-apm*, logs-apm*, and metrics-apm* indices

    Write events into Elasticsearch
  2. Assign the general writer role to users who need to publish APM data.
  3. If real user monitoring is enabled, create a separate RUM source mapping role.
« Secure communication with the Elastic Stack Grant privileges and roles needed for monitoring »