How to define Filebeat writer role?

Good morning,

We are using the hosted elasticsearch service version 7.8 as well as Filebeat 7.8.0. I'm trying to set up the writer role for filebeat instances that will only publish data. In the docs,(https://www.elastic.co/guide/en/beats/filebeat/master/privileges-to-publish-events.html) it states that it needs

cluster:admin/ingest/pipeline/get

permissions when working with modules for the writer role. We are not using logstash currently and I have already performed the setup step with an account that has permissions to do so. We'll be using the IIS module so I need to understand how to set up the writer role. I don't see anything resembling the above set of permissions in the cluster privileges options listed in Kibana. Perhaps the closest thing is manage_ingest_pipelines but I'm not entirely certain. Can someone show me an example of how I'd define this? Thanks in advance!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.