Good morning,
We are using the hosted elasticsearch service version 7.8 as well as Filebeat 7.8.0. I'm trying to set up the writer role for filebeat instances that will only publish data. In the docs,(https://www.elastic.co/guide/en/beats/filebeat/master/privileges-to-publish-events.html) it states that it needs
cluster:admin/ingest/pipeline/get
permissions when working with modules for the writer role. We are not using logstash currently and I have already performed the setup step with an account that has permissions to do so. We'll be using the IIS module so I need to understand how to set up the writer role. I don't see anything resembling the above set of permissions in the cluster privileges options listed in Kibana. Perhaps the closest thing is manage_ingest_pipelines but I'm not entirely certain. Can someone show me an example of how I'd define this? Thanks in advance!