Access to system indices

Elastic Stack Elasticsearch
1

If access to system indices is removed, can we still access them by changing users permissions or via rules? Or is it totally inaccessible?

2

Access to system indices has not been removed.

Superusers can still read from all system indices.

None of the user assignable roles that ship with Elasticsearch provide write access to system indices, but it's possible to create a custom role with write access (but this is definitely not recommended)

3

Hi Tim

Thanks for answering the question .

I was thinking about future case when it's removed as it is planned and is in pipeline.

I don't need write access, I need to read them for triggering some alerts for my team (like a new agent joined).

Thanks
Krishna

4

There are no concrete plans to remove access to system indices. If that happens we will need to consider ways to support existing use cases people might have.

5

Thanks for sharing.

Great to hear.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.