Does Filebeat have to use 'beats_system' or 'elastic' to connect to ElasticSearch?

[houmie (Houman K.)]

Sorry, which one is the best practice? Because when we run elasticsearch-setup-passwords auto it generates passwords for beats_system and elastic for us.

output.elasticsearch:
  hosts: ["localhost:9200"]
  protocol: "https"
  username: "elastic"
  password: "${ES_PASSWORD}"

Or

output.elasticsearch:
  hosts: ["localhost:9200"]
  protocol: "https"
  username: "beats_system"
  password: "${BEATS_SYSTEM_PASSWD}"

If the former is correct, then in which circumstances do we use beats_system?

Many Thanks,
Houman

[aaron-nimocks]

beats_system doesn't have the correct privileges. It's for monitoring and not ingesting data.

elastic has too many privileges you wouldn't want someone getting access to so not using it if not needed is the best practice.

I'd recommend creating a custom user/role that has the exact but minimum privileges enabled. Also you could generate an API key vs having to use keystore for the password.