# Minimum Privilege Required for Beats
**URL:** https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729
**Category:** Beats
**Tags:** auditbeat, metricbeat, filebeat, winlogbeat, packetbeat
**Created:** [September 7, 2020, 8:41am UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729 "2020-09-07T08:41:21Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@hpicass0](https://discuss.elastic.co/u/hpicass0)
#### Post date: [September 7, 2020, 8:41am UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729/1 "2020-09-07T08:41:21Z")
Hi,
Given than I need to set the API key or username/password pair in the beats config (and they might get exposed). I need to set the privilege to the absolute minimum for the relevant account
I've went over the roles here [https://www.elastic.co/guide/en/elasticsearch/reference/current/built-in-roles.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/built-in-roles.html) but I'm still not clear on the required roles (it obviously needs to add events to the DB, create an index...etc.)
The configuration we have is pretty standard and we are running version 7.9
So what are the minimum roles required for beats agents to work (Windows and Linux)
Thanks
Hosam.
---
### Author:  [@MarianaD](https://discuss.elastic.co/u/MarianaD)
#### Post date: [September 7, 2020, 2:56pm UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729/2 "2020-09-07T14:56:54Z")
hi @hpicass0, I suggest having a look here [https://www.elastic.co/guide/en/beats/filebeat/current/feature-roles.html](https://www.elastic.co/guide/en/beats/filebeat/current/feature-roles.html), with the 4 roles you can setup the required dependencies, send monitoring data and write indices in es, the 4th one is to manage the info in Kibana.
You could start with the first 3.
---
### Author:  [@hpicass0](https://discuss.elastic.co/u/hpicass0)
#### Post date: [September 9, 2020, 12:48pm UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729/3 "2020-09-09T12:48:24Z")
Thanks @MarianaD your input was definitely helpful. The current documentation doesn't list all required privileges. I've done the following to get to work:
```auto
1) Roles:
monitoring_user
beats_admin
kibana_admin
ingest_admin
remote_monitoring_agent
remote_monitoring_collector
Custom_Role
2) Custom_Role Cluster Privileges:
read_ilm
monitor
manage_ingest_pipelines
manage_pipeline
manage_index_templates
3) Custom_Role Index Privileges:
view_index_metadata
manage
write
```
Any input to make the privilege more strict is very welcomed
H.
---
### Author:  [@cruizba](https://discuss.elastic.co/u/cruizba)
#### Post date: [September 23, 2020, 9:35pm UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729/4 "2020-09-23T21:35:22Z")
Hi @hpicass0 , how did you manage to guess all these privileges? I'm having exactly the same problem you have. Thanks for sharing 🙂
Regards,
Carlos
---
### Author:  [@hpicass0](https://discuss.elastic.co/u/hpicass0)
#### Post date: [September 24, 2020, 6:34pm UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729/5 "2020-09-24T18:34:23Z")
Hey @cruizba
I started with the filebeat link shared by @MarianaD. Then did a trial and error while going over the error logs until I got it right. 😉
H.
---
### Author:  [@cruizba](https://discuss.elastic.co/u/cruizba)
#### Post date: [September 25, 2020, 12:19am UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729/6 "2020-09-25T00:19:21Z")
I think I will do the same 🙂
The privileges you've written works?
Regards,
Carlos
---
### Author:  [@hpicass0](https://discuss.elastic.co/u/hpicass0)
#### Post date: [September 25, 2020, 8:37am UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729/7 "2020-09-25T08:37:40Z")
Yes they do @cruizba.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 23, 2020, 10:37am UTC](https://discuss.elastic.co/t/minimum-privilege-required-for-beats/247729/8 "2020-10-23T10:37:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.