Does Filebeat have to use 'beats_system' or 'elastic' to connect to ElasticSearch?

Elastic Stack Beats
1

Sorry, which one is the best practice? Because when we run elasticsearch-setup-passwords auto it generates passwords for beats_system and elastic for us.

output.elasticsearch:
  hosts: ["localhost:9200"]
  protocol: "https"
  username: "elastic"
  password: "${ES_PASSWORD}"

Or

output.elasticsearch:
  hosts: ["localhost:9200"]
  protocol: "https"
  username: "beats_system"
  password: "${BEATS_SYSTEM_PASSWD}"

If the former is correct, then in which circumstances do we use beats_system?

Many Thanks,
Houman

2

beats_system doesn't have the correct privileges. It's for monitoring and not ingesting data.

image
image1686×1150 72.3 KB

elastic has too many privileges you wouldn't want someone getting access to so not using it if not needed is the best practice.

image
image1680×1154 63.5 KB

I'd recommend creating a custom user/role that has the exact but minimum privileges enabled. Also you could generate an API key vs having to use keystore for the password.