wtf

#

Maybe I’m doing something wrong, but I can’t seem to get the documented permissions necessary to write to elasticsearch to work. I run metricbeat -e setup with another user (I just use the elastic user to make it simple because this is a lab), so that’s not the issue. If I add the all index privilege it works.

After trying the all privilege I deleted the datastream, removed all and attempted to get it working again. This time I added view_index_metadata and write. This doesn’t throw the error at me, but I’m worried write is a bit heavy handed.

I might keep playing with it. I might not. We’ll see.