{
  "cluster": [
    "manage_index_templates",
    "monitor",
    "manage_ilm"
  ],
  "indices": [
    {
      "names": [
        "logs-generic-default",
        "logstash-*"
      ],
      "privileges": [
        "write",
        "create",
        "create_index",
        "manage",
        "manage_ilm"
      ]
    },
    {
      "names": [
        "logstash"
      ],
      "privileges": [
        "write",
        "manage"
      ]
    }
  ]
}

{
  "cluster": [
    "manage_index_templates",
    "monitor",
    "manage_ilm"
  ],
  "indices": [
    {
      "names": [
        "logs-generic-default",
        "logstash-*",
        "ecs-logstash-*"
      ],
      "privileges": [
        "write",
        "create",
        "create_index",
        "manage",
        "manage_ilm"
      ]
    },
    {
      "names": [
        "logstash",
        "ecs-logstash"
      ],
      "privileges": [
        "write",
        "manage"
      ]
    }
  ]
}

Adjust role for ECS compatibility
fix(logstash): Adjust role for ECS compatibility

'ecs_compatibility' is now on by default, therefore Logstash indices are
created with the naming pattern "ecs-logstash-*" when data streams are
disabled ('data_stream => false').
