# Elasticsearch ELK security
**URL:** https://discuss.elastic.co/t/elasticsearch-elk-security/179424
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [May 2, 2019, 6:18pm UTC](https://discuss.elastic.co/t/elasticsearch-elk-security/179424 "2019-05-02T18:18:30Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@euph0ria](https://discuss.elastic.co/u/euph0ria)
#### Post date: [May 2, 2019, 6:18pm UTC](https://discuss.elastic.co/t/elasticsearch-elk-security/179424/1 "2019-05-02T18:18:30Z")
Hi community,
I have a question regarding security. Suppose we setup ES + filebeat for some systems. Filebeat ships directly to ES. How do we handle security?
Basically what we are worried about is a server being compromised and the attacker using the filebeat credentials (if you use an nginx proxy) to view the logs of everything on the ES server.
I can't find any way to setup this very basic security restriction that filebeat should only be able to upload, not read nor access everything. Is this not possible in the open-source/free edition?
If so I'm extremely surprised of all the tutorials online that recommend ELK not addressing the security concerns. Is the only way to solve this using OpenDistro by AWS or pay for the X-pack?
How has every one else here using the ELK stack solved this?
---
### Author:  [@Julien](https://discuss.elastic.co/u/Julien)
#### Post date: [May 22, 2019, 11:40am UTC](https://discuss.elastic.co/t/elasticsearch-elk-security/179424/2 "2019-05-22T11:40:53Z")
If you create a role with only "write" (possibly create\_index if you want the user to be able to create index) or "index", then the user would be able to index documents but not read. Please refer to the [indices privileges documentation](https://www.elastic.co/guide/en/elastic-stack-overview/current/security-privileges.html#privileges-list-indices)
Regarding licensing, please check this blog :
[https://www.elastic.co/blog/security-for-elasticsearch-is-now-free](https://www.elastic.co/blog/security-for-elasticsearch-is-now-free)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 19, 2019, 11:40am UTC](https://discuss.elastic.co/t/elasticsearch-elk-security/179424/3 "2019-06-19T11:40:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.