Grant privileges and roles needed for publishing

Users who publish events to Elasticsearch need to create and write to Auditbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.

When using ILM, turn off the ILM setup check in the Auditbeat config file before running Auditbeat to publish events:

setup.ilm.check_exists: false

To grant the required privileges:

1. Create a writer role, called something like auditbeat_writer, that has the following privileges:

   Note

   The monitor cluster privilege and the create_doc and auto_configure privileges on auditbeat-* indices are required in every configuration.

   Type	Privilege	Purpose
   Cluster	monitor	Retrieve cluster details (e.g. version)
   Cluster	read_ilm	Read the ILM policy when connecting to clusters that support ILM.Not needed when setup.ilm.check_exists is false.
   Index	create_doc on auditbeat-* indices	Write events into Elasticsearch
   Index	auto_configure on auditbeat-* indices	Update the datastream mapping. Consider either disabling entirely or adding therule -{{beat_default_index_prefix}}-* to the cluster settingsaction.auto_create_indexto prevent unwanted indices creations from the agents.

   Omit any privileges that aren’t relevant in your environment.

2. Assign the writer role to users who will index events into Elasticsearch.