启动Heartbeat 后Logstash 服务异常

启动Heartbeat 后Logstash 服务异常

ELK版本：7.2

问题描述：

启动HeartBeat后，logstash出现如下错误：

[2019-07-26T12:25:03,061][INFO ][logstash.outputs.elasticsearch] retrying failed  action with response code: 403
 ({"type"=>"security_exception", "reason"=>"action [indices:admin/create] is unauthorized for user [logstash_internal]"})

解决办法：

按照elk官方文档，logstash配置默认的用户为：logstash_internal，默认角色为：metricbeat_writer;
如果heartbeat 服务需要通过logstash传输数据，需要添加对应角色-》索引与权限，并将角色赋给logstash_internal

role name	indices	privileges	beats
metricbeat_reader	metricbeat-*	read,view_index_metadata	metricbeat
heartbeat_reader	heartbeat-*	read,view_index_metadata	heartbeat
metricbeat_writer	metricbeat-*	write,delete,create_index	metricbeat
heartbeat_writer	heartbeat-*	write,delete,create_index	heartbeat

按上述配置后，查看heartbeat 内容，显示正常：

–END–