ES+Beats roles testing

docker-compose.yml

version: '2.2'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.2.1-SNAPSHOT
    environment:
      - "discovery.type=single-node"
      - "ELASTIC_PASSWORD=elastic"
      - xpack.license.self_generated.type=trial
      - xpack.security.enabled=true
      - xpack.ml.enabled=false
    ports:
      - 9200:9200
      - 9300:9300
  kibana:
    image: docker.elastic.co/kibana/kibana:7.2.1-SNAPSHOT
    ports:
      - 5601:5601
    environment:
      - XPACK_SECURITY_ENABLED=true
      - XPACK_ML_ENABLED=true
      - ELASTICSEARCH_USERNAME=elastic
      - ELASTICSEARCH_PASSWORD=elastic

index_writer.yml

setup.template.settings:
  index.number_of_shards: 1

setup.ilm.enabled: false

output.elasticsearch:
  hosts: ["localhost:9200"]
  username: beats_index_writer
  password: beats_index_writer

indexer.yml

# Configure output with user having beats_indexer role only.
# This assume that users did run `<beatname> setup` before.
#
# Required cluster privileges: monitor
# Required index privileges: index, view_index_metadata

setup.template.enabled: false

setup.ilm:
  enabled: true
  check_exists: false
  overwrite: false

output.elasticsearch:
  hosts: ["localhost:9200"]
  username: beats_indexer
  password: beats_indexer

kibana roles setup

PUT _security/role/beats_setup
{
  "cluster": [
    "manage_index_templates",
    "monitor",
    "manage_ilm",
    "manage_ml",
    "manage_ingest_pipelines"
  ],
  "indices": [
    {
      "names": ["filebeat-*"],
      "privileges": ["create_index", "manage"]
    }
  ],
  "applications": [
      {
        "application" : "kibana-.kibana",
        "privileges" : [
          "all"
        ],
        "resources" : [
          "*"
        ]
      }
  ]
}

PUT _security/role/beats_indexer
{
  "cluster": ["monitor"],
  "indices": [
    {
      "names": ["filebeat-*"],
      "privileges": ["index", "view_index_metadata"]
    }
  ]
}

PUT _security/role/beats_writer
{
  "cluster": ["monitor", "read_ilm", "manage_index_templates"],
  "indices": [
    {
      "names": ["filebeat-*"],
      "privileges": ["index", "view_index_metadata"]
    }
  ]
}

PUT _security/role/beats_index_writer
{
  "cluster": ["monitor", "read_ilm", "manage_index_templates"],
  "indices": [
    {
      "names": ["filebeat-*"],
      "privileges": ["index", "create_index", "view_index_metadata"]
    }
  ]
}

kibana test user setup

PUT _security/user/beats_setup
{
    "username" : "beats_setup",
    "password": "beats_setup", 
    "roles" : [
      "beats_setup",
      "kibana_user"
    ],
    "full_name" : "Beats Setup User",
    "email" : "",
    "metadata" : { },
    "enabled" : true
}

PUT _security/user/beats_indexer
{
    "username" : "beats_indexer",
    "password": "beats_indexer", 
    "roles" : [
      "beats_indexer"
    ],
    "full_name" : "Beats Indexer User",
    "email" : "",
    "metadata" : { },
    "enabled" : true
}

PUT _security/user/beats_writer
{
    "username" : "beats_writer",
    "password": "beats_writer", 
    "roles" : [
      "beats_writer"
    ],
    "full_name" : "Beats Indexer User",
    "email" : "",
    "metadata" : { },
    "enabled" : true
}

PUT _security/user/beats_index_writer
{
    "username" : "beats_index_writer",
    "password": "beats_index_writer", 
    "roles" : [
      "beats_index_writer"
    ],
    "full_name" : "Beats Indexer User",
    "email" : "",
    "metadata" : { },
    "enabled" : true
}

PUT _security/user/beats_self_managed
{
  "username": "beats_self_managed",
  "password": "beats_self_managed",
  "roles": ["beats_setup", "beats_indexer"],
  "full_name": "Beats Self Managed Used (with ILM)",
    "email" : "",
    "metadata" : { },
    "enabled" : true
}

self_managed.yml

setup.template.settings:
  overwrite: false
  index.number_of_shards: 1

setup.ilm.enabled: true

output.elasticsearch:
  hosts: ["localhost:9200"]
  username: beats_self_managed
  password: beats_self_managed

setup_ilm.yml

setup.template.settings:
  index.number_of_shards: 1

setup.kibana:
  host: "localhost:5601"

output.elasticsearch:
  hosts: ["localhost:9200"]
  username: beats_setup
  password: beats_setup

setup_index.yml

setup.template.settings:
  index.number_of_shards: 1

setup.ilm.enabled: false

setup.kibana:
  host: "localhost:5601"

setup.dashboards.directory: './build'

output.elasticsearch:
  hosts: ["localhost:9200"]
  username: beats_setup
  password: beats_setup

test.yml

filebeat.inputs:
- type: log
  paths:
    - nasa.log

writer.yml

setup.template.settings:
  overwrite: false
  index.number_of_shards: 1

setup.ilm.enabled: true

output.elasticsearch:
  hosts: ["localhost:9200"]
  username: beats_writer
  password: beats_writer