I'm puzzled by this, user attempted with has a role which got create_index,index,write on auditbeat-* same role which work for another user working for Windows auditbeats.
'Service unavailable' wouldn't that possible imply some kind of permission issue on elastic side, and if how to get details logged somehow?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.