diff --git a/libbeat/docs/security/users.asciidoc b/libbeat/docs/security/users.asciidoc
index 5ef2417ca584..d8dff16a15f3 100644
--- a/libbeat/docs/security/users.asciidoc
+++ b/libbeat/docs/security/users.asciidoc
@@ -141,6 +141,14 @@ If you don't use the +{beat_monitoring_user}+ user:
 |Cluster
 |`monitor`
 |Retrieve cluster details (e.g. version)
+
+|Index
+|`create_index` on `.monitoring-beats-*` indices
+|Create monitoring indices in {es}
+
+|Index
+|`create_doc` on `.monitoring-beats-*` indices
+|Write monitoring events into {es}
 |====
 
 . Assign the *monitoring role*, along with the following built-in roles, to