Access denied admin/aliases

I have setup a role to allow beats data to be indexed. I followed this article:

The indexes aren't created and I receive the following entry in the audit log:
{"@timestamp":"2019-06-21T10:24:44,209", "":"xxxxxxxxxxxxxxxxxxxxx", "event.type":"transport", "event.action":"access_denied", "":"ingest_user", "user.realm":"default_native", "user.roles":["ingest_role","beats_system"], "origin.type":"rest", "origin.address":"xx.xx.xx.xx:xxx", "":"xxxxxxxxxxxxxxxxxxxxxx", "action":"indices:admin/aliases", "":"CreateIndexRequest", "indices":["<metricbeat-financedept-{now/d}-000001>"]}

What additional permissions are required to resolve this?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.