# 'cluster:admin/xpack/monitoring/bulk' privilege for beats\_system
**URL:** https://discuss.elastic.co/t/cluster-admin-xpack-monitoring-bulk-privilege-for-beats-system/315753
**Category:** Elasticsearch
**Tags:** elastic-stack-monitoring
**Created:** [October 4, 2022, 9:03am UTC](https://discuss.elastic.co/t/cluster-admin-xpack-monitoring-bulk-privilege-for-beats-system/315753 "2022-10-04T09:03:57Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)
#### Post date: [October 4, 2022, 9:03am UTC](https://discuss.elastic.co/t/cluster-admin-xpack-monitoring-bulk-privilege-for-beats-system/315753/1 "2022-10-04T09:03:57Z")
On my Elasticsearch 7.x cluster, the `beats_system` role has the cluster privileges `monitor` and `cluster:admin/xpack/monitoring/bulk`.
The `cluster:admin/xpack/monitoring/bulk` privilege is not mentioned on [Security privileges | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-privileges.html). I did find the post [Privileges for built-in roles](https://discuss.elastic.co/t/privileges-for-built-in-roles/103792), which says:
> The bulk monitoring privilege is an action name.
> It grants access to a specific internal action.
I looked for a list of 'actions' and 'internal actions' in the Elasticsearch documentation. It doesn't seem like there is a reference for them. I did not find any results in the REST APIs reference either.
Question: what is this 'internal action'?
FWIW: According to [Grant privileges and roles needed for monitoring | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/privileges-to-publish-monitoring.html), a user-made role (as an alternative to using the built-in `beats_system` role) does NOT need to have this cluster privilege.
---
### Author:  [@matschaffer](https://discuss.elastic.co/u/matschaffer)
#### Post date: [October 13, 2022, 6:51am UTC](https://discuss.elastic.co/t/cluster-admin-xpack-monitoring-bulk-privilege-for-beats-system/315753/2 "2022-10-13T06:51:56Z")
I believe the internal action being referred to here is the `/_monitoring/bulk` Elasticsearch endpoint used to deliver monitoring data from Elasticsearch internal collection.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 10, 2022, 6:52am UTC](https://discuss.elastic.co/t/cluster-admin-xpack-monitoring-bulk-privilege-for-beats-system/315753/3 "2022-11-10T06:52:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.