Elasticsearch version (bin/elasticsearch --version): 7.16 (Elastic Cloud)
Description of the problem including expected versus actual behavior:
After Elasticsearch was upgraded in Elastic Cloud to 7.16, our Functionbeat stopped working. We see following error in our logs:
2021-12-08T06:42:16.576Z ERROR [publisher_pipeline_output] pipeline/output.go:154 Failed to connect to backoff(elasticsearch(https://:9243)): Connection marked as failed because the onConnect callback failed: error loading template: failure while checking if template exists: 403 Forbidden:
{
"error": {
"root_cause": [
{
"type": "security_exception",
"reason": "action [indices:admin/template/get] is unauthorized for user [functionbeat] with roles [functionbeat], this action is granted by the cluster privileges [manage_index_templates,manage,all]"
}
],
"type": "security_exception",
"reason": "action [indices:admin/template/get] is unauthorized for user [functionbeat] with roles [functionbeat], this action is granted by the cluster privileges [manage_index_templates,manage,all]"
},
"status": 403
}
This issue can circumvented by adding the manage_index_templates to the role. However, the question is why should Functionbeat need that privilege? Isn't this overly permissive? Why should Functionbeat be able to manage index templates? It's also not mentioned by Functionbeat 7.16 documentation, so I'm not sure whether this functionality is intended.
Steps to reproduce:
Set up Elasticsearch 7.16 and try to index something with Functionbeat without manage_index_template privilege. Version does not seem to matter.
Elasticsearch version (
bin/elasticsearch --version): 7.16 (Elastic Cloud)Description of the problem including expected versus actual behavior:
After Elasticsearch was upgraded in Elastic Cloud to 7.16, our Functionbeat stopped working. We see following error in our logs:
This issue can circumvented by adding the
manage_index_templatesto the role. However, the question is why should Functionbeat need that privilege? Isn't this overly permissive? Why should Functionbeat be able to manage index templates? It's also not mentioned by Functionbeat 7.16 documentation, so I'm not sure whether this functionality is intended.Steps to reproduce:
Set up Elasticsearch 7.16 and try to index something with Functionbeat without
manage_index_templateprivilege. Version does not seem to matter.