I have setup a role to allow beats data to be indexed. I followed this article:
https://www.elastic.co/guide/en/beats/metricbeat/current/feature-roles.html
The indexes aren't created and I receive the following entry in the audit log:
{"@timestamp":"2019-06-21T10:24:44,209", "node.id":"xxxxxxxxxxxxxxxxxxxxx", "event.type":"transport", "event.action":"access_denied", "user.name":"ingest_user", "user.realm":"default_native", "user.roles":["ingest_role","beats_system"], "origin.type":"rest", "origin.address":"xx.xx.xx.xx:xxx", "request.id":"xxxxxxxxxxxxxxxxxxxxxx", "action":"indices:admin/aliases", "request.name":"CreateIndexRequest", "indices":["<metricbeat-financedept-{now/d}-000001>"]}
What additional permissions are required to resolve this?