fids/observability/elk/setup/roles/filebeat_writer.json

{
  "cluster": [
    "manage_ilm",
    "manage_index_templates",
    "monitor",
    "read_pipeline"
  ],
  "indices": [
    {
      "names": [
        "filebeat-*"
      ],
      "privileges": [
        "create_doc",
        "manage"
      ]
    }
  ]
}