elasticsearch:
  privileges:
    indices: [auto_configure, create_doc, maintenance, monitor, read]

bash-4.2$ cat state/data/state.yml

action:
    ...
    inputs:
    - apm-server:
       ...
      data_stream:
        namespace: default
      id: c0f3d4d1-acc9-447c-a443-f9049dab8ee5
      meta:
        package:
          name: apm
          version: 8.1.0
      name: apm_systemtest_2-apm
      revision: 1
      type: apm
      use_output: default
    output_permissions:
      default:
        _elastic_agent_checks:
          cluster:
          - monitor
        _elastic_agent_monitoring:
         ...
        apm_systemtest_2-apm:
          cluster:
          - cluster:monitor/main
          indices:
          - names:
            - logs-apm.app-default
            privileges:
            - auto_configure
            - create_doc
          - names:
            - metrics-apm.app.*-default
            privileges:
            - auto_configure
            - create_doc
          - names:
            - logs-apm.error-default
            privileges:
            - auto_configure
            - create_doc
          - names:
            - metrics-apm.internal-default
            privileges:
            - auto_configure
            - create_doc
          - names:
            - metrics-apm.profiling-default
            privileges:
            - auto_configure
            - create_doc
          - names:
            - traces-apm.rum-default
            privileges:
            - auto_configure
            - create_doc
          - names:
            - traces-apm.sampled-default
            privileges:
            - auto_configure
            - create_doc
            - maintenance
            - monitor
            - read
          - names:
            - traces-apm-default
            privileges:
            - auto_configure
            - create_doc
    outputs:
      default:
        api_key: vOL9Cn4BqaHYuqz-hbSb:Iboop-tIQjKH7tLzzFH0Yg
        hosts:
        - http://elasticsearch:9200
        type: elasticsearch
    revision: 2

simitt@simmac ~ % curl -H "Authorization: ApiKey dk9MOUNuNEJxYUhZdXF6LWhiU2I6SWJvb3AtdElRaktIN3RMenpGSDBZZw==" -X GET "localhost:9200/_security/user/_has_privileges?pretty" -H 'Content-Type: application/json' -d'
{
  "cluster": [ "cluster:monitor/main" ],
  "index" : [
    {
      "names": [ "logs-apm.app-default", "metrics-apm.app.*-default", "logs-apm.error-default", "metrics-apm.internal-default", "metrics-apm.profiling-default", "traces-apm.rum-default", "traces-apm-default" ],
      "privileges": [ "auto_configure","create_doc" ]
    },
    {
      "names": [ "traces-apm.sampled-default" ],
      "privileges": [ "auto_configure","create_doc","maintenance","monitor","read" ]
    }
  ]
}
'



{
  "username" : "elastic/fleet-server",
  "has_all_requested" : false,
  "cluster" : {
    "cluster:monitor/main" : true
  },
  "index" : {
    "logs-apm.app-default" : {
      "create_doc" : true,
      "auto_configure" : true
    },
    "logs-apm.error-default" : {
      "create_doc" : true,
      "auto_configure" : true
    },
    "metrics-apm.app.*-default" : {
      "create_doc" : true,
      "auto_configure" : true
    },
    "metrics-apm.internal-default" : {
      "create_doc" : true,
      "auto_configure" : true
    },
    "metrics-apm.profiling-default" : {
      "create_doc" : true,
      "auto_configure" : true
    },
    "traces-apm-default" : {
      "create_doc" : true,
      "auto_configure" : true
    },
    "traces-apm.rum-default" : {
      "create_doc" : true,
      "auto_configure" : true
    },
    "traces-apm.sampled-default" : {
      "read" : false,
      "create_doc" : true,
      "auto_configure" : true,
      "monitor" : false,
      "maintenance" : false
    }
  },
  "application" : { }
}

simitt@simmac ~ % curl -i -H "Authorization: ApiKey dk9MOUNuNEJxYUhZdXF6LWhiU2I6SWJvb3AtdElRaktIN3RMenpGSDBZZw==" "http://localhost:9200/traces-apm-default/_search"
HTTP/1.1 403 Forbidden
X-elastic-product: Elasticsearch
content-type: application/json;charset=utf-8
content-length: 621

{"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for API key id [vOL9Cn4BqaHYuqz-hbSb] of user [elastic/fleet-server] on indices [traces-apm-default,.ds-traces-apm-default-2021.12.30-000001], this action is granted by the index privileges [read,all]"}],"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for API key id [vOL9Cn4BqaHYuqz-hbSb] of user [elastic/fleet-server] on indices [traces-apm-default,.ds-traces-apm-default-2021.12.30-000001], this action is granted by the index privileges [read,all]"},"status":403}%