Hi
Elastic 7.15.1
After configuring metricbeat module elasticsearc-xpack, I am getting the following error in elasticsearch log files:
[2021-11-04T18:04:32,698][ERROR][o.e.x.i.IndexLifecycleRunner] [XXXXXXXXXXXXX] policy [metricbeat] for index [metricbeat-7.15.1-2021.11.04-000001] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step
org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/rollover] is unauthorized for user [remote_monitoring_user] with roles [remote_monitoring_collector,remote_monitoring_agent] on indices [metricbeat-7.15.1-2021.11.04-000001,metricbeat-7.15.1], this action is granted by the index privileges [manage_follow_index,manage,all]
I am using "remote_monitoring_user" to collect and ship these logs.
I tried also beats_system, but this was lacking even more permissions. Also user "elastic" seems like overkill.
What user I should be using to collect/ship metricbeat logs..?
Or am I supposed to use separate users for log collecting and log shiping tasks..?
Regards
Raul