Well, now i have this error with beats_system and ingest_admin permissions for beat user:
action [indices:admin/create] is unauthorized for user [metricbeat_internal]
What index (or index pattern) requires this permission?
I already have create , create_index , write , manage_ilm permissions on metricbeat-* index pattern.