# Logstash user permissions

**URL:** <https://discuss.elastic.co/t/logstash-user-permissions/304049>\
**Category:** Logstash\
**Created:** [May 5, 2022, 3:06pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049 "2022-05-05T15:06:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ksobon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksobon/32/103774_2.png) [@ksobon](https://discuss.elastic.co/u/ksobon)\
**Post date:** [May 5, 2022, 3:06pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049/1 "2022-05-05T15:06:55Z")

</div>

I have configured a "logstash" user with the following set of permissions:

```auto
"{
	"indices": [{
			"names": ["*beat*"],
			"privileges": ["create", "create_index", "view_index_metadata"]
		}
	]
}"

```

That however results in permission exceptions getting thrown when Logstash is first started. They are related to setting up of templates. I have looked into which permissions would clear these exceptions up, and concluded that adding cluster permissions to `manage_index_templates` and `monitor` clears that up.

My question is the following. Are `manage_index_templates` and `monitor` permissions ok to be added to logstash user, or is that some kind of a security issue? What would be an alternative way to address these template exceptions? Thoughts?

My proposed new set of permissions:

```auto
"{"cluster":["manage_index_templates","monitor"],"indices":[{"names":["*beat*"],"privileges":["create","create_index","view_index_metadata"]}]}";

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 5, 2022, 4:01pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049/2 "2022-05-05T16:01:16Z")

</div>

The [documentation](https://www.elastic.co/guide/en/logstash/current/ls-security.html#ls-http-auth-basic) shows which permissions are needed, although it decomposes them into three roles which are then assigned to users.

---

<div class="post-metadata">

**Author:** ![ksobon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksobon/32/103774_2.png) [@ksobon](https://discuss.elastic.co/u/ksobon)\
**Post date:** [May 5, 2022, 4:14pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049/3 "2022-05-05T16:14:17Z")

</div>

> [@ksobon](#):
>
> My question is the following. Are `manage_index_templates` and `monitor` permissions ok to be added to logstash user, or is that some kind of a security issue?

Any comments on this? I just want to make sure that I am not exposing my Elastic Cloud cluster to potential security vulnerability by adding cluster permissions to logstash user. Would that be a concern for you? Am I overreacting here?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 5, 2022, 4:32pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049/4 "2022-05-05T16:32:30Z")

</div>

> [@ksobon](#):
>
> Any comments on this?

I am hoping someone from elastic will comment on this.

---

<div class="post-metadata">

**Author:** ![ksobon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ksobon/32/103774_2.png) [@ksobon](https://discuss.elastic.co/u/ksobon)\
**Post date:** [May 5, 2022, 5:14pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049/5 "2022-05-05T17:14:16Z")

</div>

Do you know anyone from Elastic that roams these forums that we can cc here? I am just looking for quick thumbs up or down on this question. Like you mentioned, their documentation for the logstash\_writer user actually has a few more permissions, so I don't know if I am not inventing an issue here for no reason. Thanks!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 5, 2022, 5:25pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049/6 "2022-05-05T17:25:06Z")

</div>

From the docs...

```auto
POST _security/role/logstash_writer
{
  "cluster": ["manage_index_templates", "monitor", "manage_ilm"], 
  "indices": [
    {
      "names": ["logstash-*", "*beats*"], 
      "privileges": ["write","create","create_index","manage","manage_ilm"]  
    }
  ]
}

```

```auto
POST _security/user/logstash_internal
{
  "password" : "x-pack-test-password",
  "roles" : ["logstash_writer"],
  "full_name" : "Internal Logstash User"
}

```

> [@ksobon](#):
>
> Any comments on this? I just want to make sure that I am not exposing my Elastic Cloud cluster to potential security vulnerability by adding cluster permissions to logstash user. Would that be a concern for you? Am I overreacting here?

This is our best practice... you can take the other roles out but if anyone sets manage\_template or tries to monitor logstash (which is also a best practice) it will fail... It is up to you.

The assumption is that you are properly managing the user credential that are assigned to that user and thus access to that role through use of the encrypted keystore etc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2022, 5:25pm UTC](https://discuss.elastic.co/t/logstash-user-permissions/304049/7 "2022-06-02T17:25:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.