Hi,
I'm testing the to install logstash with helm from https://github.com/elastic/helm-charts.
Everything works fine except that logstash is not able to query index and get a 403 forbidden when another user than elastic or superuser is used in the elastic plugin user field.
The exact same configuration with only read privilege for the user and this is working fine.
So this seems to be only related to logstash running with helm but this is obviously not ideal from a security point of view to give a lot of privilege to only fetch logs.
Does anybody already encounter that and have an idea how to fix?