From the docs...
POST _security/role/logstash_writer
{
"cluster": ["manage_index_templates", "monitor", "manage_ilm"],
"indices": [
{
"names": [ "logstash-*", "*beats*" ],
"privileges": ["write","create","create_index","manage","manage_ilm"]
}
]
}
POST _security/user/logstash_internal
{
"password" : "x-pack-test-password",
"roles" : [ "logstash_writer"],
"full_name" : "Internal Logstash User"
}
This is our best practice... you can take the other roles out but if anyone sets manage_template or tries to monitor logstash (which is also a best practice) it will fail... It is up to you.
The assumption is that you are properly managing the user credential that are assigned to that user and thus access to that role through use of the encrypted keystore etc.