# 'monitor' privilege for beats\_system
**URL:** https://discuss.elastic.co/t/monitor-privilege-for-beats-system/315754
**Category:** Elasticsearch
**Tags:** elastic-stack-monitoring
**Created:** [October 4, 2022, 9:11am UTC](https://discuss.elastic.co/t/monitor-privilege-for-beats-system/315754 "2022-10-04T09:11:06Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)
#### Post date: [October 4, 2022, 9:11am UTC](https://discuss.elastic.co/t/monitor-privilege-for-beats-system/315754/1 "2022-10-04T09:11:06Z")
On my Elasticsearch 7.x cluster, the `beats_system` role has the cluster privileges `monitor` and `cluster:admin/xpack/monitoring/bulk`.
According to [Grant privileges and roles needed for monitoring | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/privileges-to-publish-monitoring.html), a user-made role (as an alternative to using the built-in `beats_system` role) should also have these privileges.
According to [Security privileges | Elasticsearch Guide [7.17] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-privileges.html), roles with the the cluster `monitor` privilege have access to:
> All cluster read-only operations, like cluster health and state, hot threads, node info, node and cluster stats, and pending cluster tasks.
Question:
According to [Use internal collection to send monitoring data | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/monitoring-internal-collection.html), the internal collector (for which the monitoring user is used) is used to "send Beats monitoring data directly to your monitoring cluster".
Why should the Filebeat monitoring user be able to read the Elasticsearch monitoring cluster's own monitoring data?
---
### Author:  [@matschaffer](https://discuss.elastic.co/u/matschaffer)
#### Post date: [October 13, 2022, 6:40am UTC](https://discuss.elastic.co/t/monitor-privilege-for-beats-system/315754/2 "2022-10-13T06:40:10Z")
I believe the `monitor` privilege is required for version checks, alias checks, and load balancing requests across the nodes of the target Elasticsearch cluster.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 10, 2022, 6:40am UTC](https://discuss.elastic.co/t/monitor-privilege-for-beats-system/315754/3 "2022-11-10T06:40:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.