Users who publish events to Elasticsearch need to create and write to Winlogbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.
When using ILM, turn off the ILM setup check in the Winlogbeat config file before running Winlogbeat to publish events:
To grant the required privileges:
Create a writer role, called something like
winlogbeat_writer, that has the following privileges:
monitorcluster privilege and the
winlogbeat-*indices are required in every configuration.
Type Privilege Purpose
Retrieve cluster details (e.g. version)
Read the ILM policy when connecting to clusters that support ILM. Not needed when
Write events into Elasticsearch
Check for alias when connecting to clusters that support ILM. Not needed when
Create daily indices when connecting to clusters that do not support ILM. Not needed when using ILM.
Omit any privileges that aren’t relevant in your environment.
- Assign the writer role to users who will index events into Elasticsearch.