In the documentation the permissions needed for a Beats user are ok for a setup that doesn't use one of the default modules.

But, if I configure the use of the system module in Filebeat for example, the user that I need to create does require manage_pipeline permission, because the modules do have pre-defined ingest pipelines that are added to Elasticsearch. In a configuration where Filebeat sends the events directly to ES, of course.