Is it possible to configure logstash so that it can only append to an index in elastic, but without being able to create indexes, and delete or overwrite data?
We need this so that the stack can be accredited for use in a government org.
I assume you are using xpack, with that you could create a user with specific rights and use that user to add data to elasticsearch. Out of the box I don't think LS can prevent such actions.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.