# Windows filebeat cluster privileges
**URL:** https://discuss.elastic.co/t/windows-filebeat-cluster-privileges/293258
**Category:** Beats
**Tags:** elastic-stack-security, filebeat
**Created:** [December 31, 2021, 2:49pm UTC](https://discuss.elastic.co/t/windows-filebeat-cluster-privileges/293258 "2021-12-31T14:49:56Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mcosta](https://discuss.elastic.co/u/mcosta)
#### Post date: [December 31, 2021, 2:49pm UTC](https://discuss.elastic.co/t/windows-filebeat-cluster-privileges/293258/1 "2021-12-31T14:49:56Z")
Hi,
I installed Filebeat (7.16.2) on Windows Server, using default PowerShell script and started it as a service.
It reads some custom log files and send them to Elasticsearch. It uses a custom index, ILM policy and template so I had some initial problems dealing with Filebeat configuration but now it works fine. It also uses a newly created user having his password stored on a keystore to avoid plain text passwords on configuration file.
As far as I could test it only runs (start and update index when there are new records on log files) if user's role have the following set of privileges:
- Cluster: read\_ilm, monitor, manage\_index\_templates
- Index: create\_index, view\_index\_metadata, write
All this was a test to find both Filebeat and Elastcisearch configurations. QA and Production deployments of this solution will be done by someone else. I don't even have access to the Windows server where Filebeat will run. So, my main questions are:
Is it possible to run with less privileges? Am I doing anything wrong that should be done some other way?
For instance, "manage\_index\_templates" will allow this user to manage _all_ other index templates on this Cluster, right? That could be a security problem.
Thank you and _HAPPY NEW YEAR_
---
### Author:  [@kvch](https://discuss.elastic.co/u/kvch)
#### Post date: [January 3, 2022, 12:33pm UTC](https://discuss.elastic.co/t/windows-filebeat-cluster-privileges/293258/2 "2022-01-03T12:33:20Z")
Have you seen this documentation page about giving access to resources on ES and why specific roles are needed? [Grant users access to secured resources | Filebeat Reference [7.16] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/feature-roles.html)
Let me know if you have further questions.
---
### Author:  [@mcosta](https://discuss.elastic.co/u/mcosta)
#### Post date: [January 5, 2022, 9:18pm UTC](https://discuss.elastic.co/t/windows-filebeat-cluster-privileges/293258/3 "2022-01-05T21:18:33Z")
Hi Noémi
Thank you for your reply.
Somehow I missed that documentation but thanks to the great explicit error logging output from Filebeat, I was able to tune the above privileges.
Refering to documentation, suggested "writer role" needed for publishing, includes cluster monitor, read\_ilm and read\_pipeline privileges but not manage\_index\_templates. Without manage\_index\_templates set for this user's role I get the error:
ERROR [publisher\_pipeline\_output] pipeline/output.go:154 Failed to connect to backoff(Elasticsearch([https://elasticq.bdso.local:9200](https://elasticq.bdso.local:9200))): Connection marked as failed because the onConnect callback failed: error loading template: failure while checking if template exists: 403 Forbidden
Any suggestion?
Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 2, 2022, 11:18pm UTC](https://discuss.elastic.co/t/windows-filebeat-cluster-privileges/293258/4 "2022-02-02T23:18:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.