I decided to throw out the API key (temporarily) and use an account with more privileges just long enough to see what it was trying to do.
It appears it is creating an index named Winlogbeat-7.9.1 and writing to that rather than doing something like Winlogbeat-7.9.1-000001 with a write alias. Is this expected behavior?
Just a note: I've created a setup role as outlined here and ran .\winlogbeat.exe setup -e with it to set up the index template, aliases, etc.
I'm really not sure what [indices:admin/auto_create] is. I don't see such a privilege defined here. I'm at a loss on this one. I believe I am confusing myself more the more I look into it.
I may be able to just bootstrap an index with write alias and have Winlogbeat just write to the write alias, but isn't this all supposed to be handled by Winlogbeat now?