# Beats privileges documentation **URL:** \ **Category:** Beats\ **Created:** [January 8, 2020, 8:46am UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190 "2020-01-08T08:46:01Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![jsu](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jsu](https://discuss.elastic.co/u/jsu)\ **Post date:** [January 8, 2020, 8:46am UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/1 "2020-01-08T08:46:01Z")
Hi there, I had a problem that I managed to resolve but it seems then that the documentation isn't completely accurate. Let me know if I should post this somewhere else. So, when configuring Beats agents to send data to a cluster with security activated, I followed [this documentation](https://www.elastic.co/guide/en/beats/metricbeat/7.5/feature-roles.html#privileges-to-publish-events) and configured a user having a "writer role" with the privileges `create_doc` and `view_index_metadata` for all the `metricbeat-*`,` filebeat-*` and other `*beat-*` as specified in the doc. The Beats were able to connect to the cluster but no data was coming in. The solution was to actually give this role the `create_doc` and `view_index_metadata` privileges for all indices `*` and the data began flowing. As far as I know, it's not mentioned anywhere in the doc that privileges need to be applied to more than the specific `*beat-*` indices. Is it indeed a problem with the documentation ? ps : my indices do have the regular patterns `*beat-*`. pps : I linked the doc for Metricbeat, but it's the same for others ([here for Auditbeat](https://www.elastic.co/guide/en/beats/auditbeat/7.5/feature-roles.html#privileges-to-publish-events)) ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [January 8, 2020, 6:16pm UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/2 "2020-01-08T18:16:32Z")
Thanks for reporting this issue. I will see if I can reproduce the problem. `view_index_metadata` on all indices was not required when I tested the privileges several months ago, but it's possible that something changed under the hood, or maybe the content changed. Note that there's also a github issue open that indicates problems with the documented privileges: [https://github.com/elastic/beats/issues/15040](https://github.com/elastic/beats/issues/15040). I'll update the github issue to remind me to post back on this thread when I've figured out the problem. Thanks again! ---
**Author:** ![jsu](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jsu](https://discuss.elastic.co/u/jsu)\ **Post date:** [January 9, 2020, 4:29pm UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/3 "2020-01-09T16:29:52Z")
Thanks for your answer ! Actually the problem should mainly be the `create_doc` on all indices if ILM is enabled. Thanks for the github issue, couldn't find it while I checked before posting here. Would you prefer me to post there ? And should I post github issues instead of here when I encounter things like this ? ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [January 9, 2020, 7:13pm UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/4 "2020-01-09T19:13:29Z")
It's a good idea to post to this forum first in case the problem is user error. Thanks again for your input. I'll take a look at this as soon as I'm able. ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [January 16, 2020, 2:06am UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/5 "2020-01-16T02:06:21Z")
Hi. Just an update that I was unable to reproduce this problem. However I did notice that the docs were ambiguous (it wasn't clear that the privileges documented for the writer role assume that you've already run the setup using the roles described for setup). See [https://github.com/elastic/beats/pull/15604](https://github.com/elastic/beats/pull/15604). ---
**Author:** ![jsu](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jsu](https://discuss.elastic.co/u/jsu)\ **Post date:** [January 16, 2020, 9:19am UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/6 "2020-01-16T09:19:33Z")
Thanks a lot for your answers. After reading that you weren't able to reproduce the problem, I went back to testing and I actually found out what was wrong. The documentation mentions to give the `create_doc` privilege to all `metricbeat-*` (I'll take metricbeat as example) indices, which I did as my indices are named following the pattern `metricbeat-000001`. But, as I have ILM enabled, I created a `metricbeat` alias that points to the last `metricbeat-*` index to write, and to all `metricbeat-*` indices to read. When I configure the `metricbeat_writer` role with the `create_doc` privilege on `metricbeat`, and not `metricbeat-*`, everything works ! I understand why giving the privilege on `metricbeat` works, but I don't understand why giving it to `metricbeat-*` doesn't. At the end, data is written on an index, not the alias itself. ---
**Author:** ![jsu](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jsu](https://discuss.elastic.co/u/jsu)\ **Post date:** [January 29, 2020, 1:17pm UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/7 "2020-01-29T13:17:43Z")
So, maybe it wasn't really clear with my previous answer, but I was wondering why this behavior is happening. Do you have any idea @dedemorton ? ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [February 3, 2020, 10:01pm UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/8 "2020-02-03T22:01:28Z")
Sorry about my delayed response. I was on vacation. You can read about alias behavior in the [Elasticsearch docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/securing-aliases.html#securing-aliases). The gist is that when Metricbeat sends events to ES, it's using the alias in the API call, not the concrete index behind the alias. ---
**Author:** ![jsu](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jsu](https://discuss.elastic.co/u/jsu)\ **Post date:** [February 4, 2020, 1:00pm UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/9 "2020-02-04T13:00:11Z")
No problem and thanks a lot for the answer ! (and the link that, for some reason, I missed) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 3, 2020, 3:00pm UTC](https://discuss.elastic.co/t/beats-privileges-documentation/214190/10 "2020-03-03T15:00:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.