Winlogbeat features that require authorizationedit

After securing Winlogbeat, make sure your users have the roles (or associated privileges) required to use these Winlogbeat features. Note that some of the roles shown here are built-in, and some are user-defined.

Feature Role

Send data to a secured cluster

winlogbeat_writer [1]

Load index templates

winlogbeat_writer [1] and kibana_user

Load Winlogbeat dashboards into Kibana

winlogbeat_writer [1] and kibana_user

Load machine learning jobs


Read indices created by Winlogbeat

winlogbeat_reader [1]

View Winlogbeat dashboards in Kibana


Load index lifecycle policies and use index lifecycle management

winlogbeat_ilm [1]

To create the user-defined roles shown here, see Configure authentication credentials and Grant users access to Winlogbeat indices. You may want to define additional roles to provide more restrictive access.

[1] These roles are user-defined.