IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Grant users access to secured resources Grant privileges and roles needed for monitoring »
Elastic Docs › ›Legacy APM Server Reference ›Secure APM Server ›Grant users access to secured resources

Grant privileges and roles needed for writing events

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Grant privileges and roles needed for writing events

edit

This documentation refers to configuring the standalone (legacy) APM Server. This method of running APM Server will be deprecated and removed in a future release. Please consider upgrading to Fleet and the APM integration.

APM users that publish events to Elasticsearch need privileges to write to APM data streams.

General writer role
edit

To grant an APM user the required privileges for writing events to Elasticsearch:

  1. Create a general writer role, called something like apm_writer, that has the following privileges:

    Type Privilege Purpose

    Index

    auto_configure on traces-apm*, logs-apm*, and metrics-apm* indices

    Permits auto-creation of indices and data streams

    Index

    create_doc on traces-apm*, logs-apm*, and metrics-apm* indices

    Write events into Elasticsearch
  2. If real user monitoring is enabled, additional privileges are required to read source maps. See RUM source map API for more details. Assign these extra privileges to the general writer role.
  3. Assign the general writer role to users who need to publish APM data.
« Grant users access to secured resources Grant privileges and roles needed for monitoring »