Grant privileges and roles needed for publishingedit

Users who publish events to Elasticsearch need to create and write to Functionbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.

When using ILM, turn off the ILM setup check in the Functionbeat config file before running Functionbeat to publish events:

setup.ilm.check_exists: false

To grant the required privileges:

  1. Create a writer role, called something like functionbeat_writer, that has the following privileges:

    The monitor cluster privilege and the create_doc and auto_configure privileges on functionbeat-* indices are required in every configuration.

    Type Privilege Purpose



    Retrieve cluster details (e.g. version)



    Read the ILM policy when connecting to clusters that support ILM. Not needed when setup.ilm.check_exists is false.


    create_doc on functionbeat-* indices

    Write events into Elasticsearch


    auto_configure on functionbeat-* indices

    Update the datastream mapping. Consider either disabling entirely or adding the rule functionbeat-* to the cluster settings action.auto_create_index to prevent unwanted indices creations from the agents.

    Omit any privileges that aren’t relevant in your environment.

  2. Assign the writer role to users who will index events into Elasticsearch.