# Роль c доступом CRUD и созданием индексов
curl -k -u admin:'<ADMIN_PASSWORD>' -X PUT \
  "https://<IP_OpenSearch>:9200/_plugins/_security/api/roles/filebeat_writer" \
  -H 'Content-Type: application/json' -d '{
  "index_permissions": [
    { "index_patterns": ["filebeat-*"], "allowed_actions": ["crud","create_index"] }
  ]
}'

# Пользователь
curl -k -u admin:'<ADMIN_PASSWORD>' -X PUT \
  "https://<IP_OpenSearch>:9200/_plugins/_security/api/user/filebeat_ingest" \
  -H 'Content-Type: application/json' -d '{
  "password": "<STRONG_PASSWORD>",
  "attributes": {}
}'

# Привязка роли к пользователю
curl -k -u admin:'<ADMIN_PASSWORD>' -X PUT \
  "https://<IP_OpenSearch>:9200/_plugins/_security/api/rolesmapping/filebeat_writer" \
  -H 'Content-Type: application/json' -d '{
  "users": ["filebeat_ingest"]
}'