argos/deployment/elk/setup/roles/filebeat_writer.json

{
    "cluster": [
      "manage_ilm",
      "manage_index_templates",
      "manage_ingest_pipelines",
      "monitor",
      "read_pipeline"
    ],
    "indices": [
      {
        "names": [
          "filebeat-*"
        ],
        "privileges": [
          "create_doc",
          "manage"
        ]
      }
    ]
  }