For confirmed bugs, please report:
User in above discuss link faced some trouble when following the docs for Securing Beats.
Docs for step 4, Set the password for the beats_system built-in user, make reference to a beats_system user that doesn't exist in Elastic Cloud. (A role beats_system exists, though).
User faced further problems due to this:
2018-11-02T18:03:21.874Z ERROR pipeline/output.go:121 Failed to publish
events: 403 Forbidden: {"error":{"root_cause":[{"type":"security_exception",
"reason":"action [cluster:admin/xpack/monitoring/bulk] is unauthorized for user
[filebeat]"}],"type":"security_exception","reason":"action
[cluster:admin/xpack/monitoring/bulk] is unauthorized for user [filebeat]"},
"status":403}
This problem went away when adding the role beats_system to the user that was used by Filebeat.
For confirmed bugs, please report:
User in above discuss link faced some trouble when following the docs for Securing Beats.
Docs for step 4, Set the password for the beats_system built-in user, make reference to a
beats_systemuser that doesn't exist in Elastic Cloud. (A rolebeats_systemexists, though).User faced further problems due to this:
This problem went away when adding the role
beats_systemto the user that was used by Filebeat.