Confused about filebeat privileges / ILM

Elastic Stack Beats
,
1

Hey folks,

I am just starting to work with the ELK stack and I am quite often confused by the documentation.

For example while setting up filebeat, Grant privileges and roles needed for publishing tells me

When using ILM, turn off the ILM setup check in the Filebeat config file before running Filebeat to publish events: setup.ilm.check_exists: false

  1. Am I using ILM? It's the first time I am reading this acronym after setting up a basic ES cluster...
  2. Why do I have to turn off the setup check if I use it? This seems to oppose each other?

It then tells me to add a read_ilm privilege which is Not needed when setup.ilm.check_exists is false..

So it first tells me to set it to false and then tells me to add the privilege unless I have set it to false?

This is quite confusing.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.