Action [indices:admin/rollover] is unauthorized for user [remote_monitoring_user] with roles


Elastic 7.15.1

After configuring metricbeat module elasticsearc-xpack, I am getting the following error in Elasticsearch log files:

[2021-11-04T18:04:32,698][ERROR][o.e.x.i.IndexLifecycleRunner] [XXXXXXXXXXXXX] policy [metricbeat] for index [metricbeat-7.15.1-2021.11.04-000001] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step
org.Elasticsearch.ElasticsearchSecurityException: action [indices:admin/rollover] is unauthorized for user [remote_monitoring_user] with roles [remote_monitoring_collector,remote_monitoring_agent] on indices [metricbeat-7.15.1-2021.11.04-000001,metricbeat-7.15.1], this action is granted by the index privileges [manage_follow_index,manage,all]

I am using "remote_monitoring_user" to collect and ship these logs.

I tried also beats_system, but this was lacking even more permissions. Also user "elastic" seems like overkill.

What user I should be using to collect/ship metricbeat logs..?
Or am I supposed to use separate users for log collecting and log shiping tasks..?


Anyone ?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.