Winlogbeat API Key Permissions

Elastic Stack Beats
5

I've resolved this. I'm not sure exactly where the issue was, but this is what I did:

  1. Removed setup.ilm.check_exists: false from Winlogbeat.yml
  2. Added setup.ilm.rollover_alias: "winlogbeat" to Winlogbeat.yml
  3. Re-ran .\winlogbeat.exe setup -e
  4. Adjusted my API key publishing role to point to winlogbeat* index rather than winlogbeat-* (needed for "winlogbeat" rollover_alias)
  5. Changed create privilege on monitoring role to create_doc (I don't believe this did anything for this particular issue, but I noticed there was a conflict between this doc and this doc - I changed it to match the latter since it seems more restrictive)

I'm pretty sure I had ILM misconfigured with setup.ilm.check_exists set to false, although I'm not 100%. The docs aren't very clear.