roles

beats_writer

PUT _security/role/beats_writer

{
  "cluster": ["monitor","read_ilm","read_pipeline"],
  "indices": [
    {
      "names": ["filebeat-*","metricbeat-*","auditbeat-*","packetbeat-*"],
      "privileges": ["create_doc"]
    }
  ]
}

wafflers

The users on the wafflelab.

PUT _security/role/wafflers

{
  "cluster": ["monitor","manage_own_api_key"],
  "indices": [
    {
      "names": ["*"],
      "privileges": ["read","monitor","view_index_metadata"],
      "allow_restricted_indices": false
    }
  ],
  "applications": [],
  "run_as": [],
  "metadata": {},
  "transient_metadata": {
    "enabled": true
  }
}