Grant privileges and roles needed for publishing

Users who publish events to Elasticsearch need to create and write to Winlogbeat indices. To minimize the privileges required by the writer role, use the setup role to pre-load dependencies. This section assumes that you’ve run the setup.

When using ILM, turn off the ILM setup check in the Winlogbeat config file before running Winlogbeat to publish events:

setup.ilm.check_exists: false

Winlogbeat checks for ingest pipelines and loads them when it connects to Elasticsearch.

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. To skip this runtime pipeline check after the required pipelines have been loaded, or when pipelines are managed separately, set:

setup.pipelines.enabled: false

To grant the required privileges:

Create a writer role, called something like winlogbeat_writer, that has the following privileges:

Note

The monitor cluster privilege and the create_doc and auto_configure privileges on winlogbeat-* indices are required in every configuration.

Type	Privilege	Purpose
Cluster	`monitor`	Retrieve cluster details (e.g. version)
Cluster	`read_ilm`	Read the ILM policy when connecting to clusters that support ILM.Not needed when `setup.ilm.check_exists` is `false`.
Cluster	`read_pipeline`	Check for ingest pipelines used by Winlogbeat. Not needed when `setup.pipelines.enabled` is `false`. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Index	`create_doc` on `winlogbeat-*` indices	Write events into Elasticsearch
Index	`auto_configure` on `winlogbeat-*` indices	Update the datastream mapping. Consider either disabling entirely or adding therule `-{{beat_default_index_prefix}}-*` to the cluster settingsaction.auto_create_indexto prevent unwanted indices creations from the agents.

Omit any privileges that aren’t relevant in your environment.

Assign the writer role to users who will index events into Elasticsearch.