Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update guide for monitoring with Elastic Agent to include also `` role #16135

Open
andsel opened this issue May 3, 2024 · 0 comments
Open

Update guide for monitoring with Elastic Agent to include also `` role #16135

andsel opened this issue May 3, 2024 · 0 comments

Comments

@andsel
Copy link
Contributor

andsel commented May 3, 2024

Tell us about the issue

Description:
Following the guide Collect Logstash monitoring data for stack monitoring it's requested to create a user with role remote_monitoring_collector , but that's not enough. With just that role, the ElasticAgent logs the following erro message:

{
"log.level":"error",
"@timestamp":"2024-05-03T08:44:22.747Z",
"message":"failed to perform any bulk index operations: 403 Forbidden: {\"error\":{\"root_cause\":[{\"type\":\"security_exception\",\"reason\":\"action [indices:data/write/bulk] is unauthorized for user [logstash_collector] with effective roles [remote_monitoring_collector] (assigned roles [create,create_doc,delete,index,write] were not found), this action is granted by the index privileges [create_doc,create,delete,index,write,all]\"}],\"type\":\"security_exception\",\"reason\":\"action [indices:data/write/bulk] is unauthorized for user [logstash_collector] with effective roles [remote_monitoring_collector] (assigned roles [create,create_doc,delete,index,write] were not found), this action is granted by the index privileges [create_doc,create,delete,index,write,all]\"},\"status\":403}",
"component":
   {"binary":"filebeat",
     "dataset":"elastic_agent.filebeat",
     "id":"log-default",
      "type":"log"},
"log":
    {"source":"log-default"},
"log.logger":"elasticsearch",
"log.origin":
   {"file.line":258,
    "file.name":"elasticsearch/client.go"},
"service.name":"filebeat",
"ecs.version":"1.6.0",
"ecs.version":"1.6.0"
}

but roles named create,create_doc,delete,index,write cited in (assigned roles [create,create_doc,delete,index,write] were not found), doesn't exists, are just privileges.

Adding also the role remote_monitor_agent fixes the problem

URL:
https://www.elastic.co/guide/en/logstash/current/monitoring-with-elastic-agent.html

Anything else?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants