# Action \[indices:admin/rollover\] is unauthorized for user \[remote\_monitoring\_user\] with roles

**URL:** <https://discuss.elastic.co/t/action-indices-admin-rollover-is-unauthorized-for-user-remote-monitoring-user-with-roles/288481>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 5, 2021, 9:42am UTC](https://discuss.elastic.co/t/action-indices-admin-rollover-is-unauthorized-for-user-remote-monitoring-user-with-roles/288481 "2021-11-05T09:42:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![raulk89](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@raulk89](https://discuss.elastic.co/u/raulk89)\
**Post date:** [November 5, 2021, 9:42am UTC](https://discuss.elastic.co/t/action-indices-admin-rollover-is-unauthorized-for-user-remote-monitoring-user-with-roles/288481/1 "2021-11-05T09:42:01Z")

</div>

Hi

Elastic 7.15.1

After configuring metricbeat module elasticsearc-xpack, I am getting the following error in elasticsearch log files:

> [2021-11-04T18:04:32,698][ERROR][o.e.x.i.IndexLifecycleRunner] [XXXXXXXXXXXXX] policy [metricbeat] for index [metricbeat-7.15.1-2021.11.04-000001] failed on step [{"phase":"hot","action":"rollover","name":"check-rollover-ready"}]. Moving to ERROR step  
> org.elasticsearch.ElasticsearchSecurityException: action [indices:admin/rollover] is unauthorized for user [remote\_monitoring\_user] with roles [remote\_monitoring\_collector,remote\_monitoring\_agent] on indices [metricbeat-7.15.1-2021.11.04-000001,metricbeat-7.15.1], this action is granted by the index privileges [manage\_follow\_index,manage,all]

I am using "remote\_monitoring\_user" to collect and ship these logs.

I tried also beats\_system, but this was lacking even more permissions. Also user "elastic" seems like overkill.

What user I should be using to collect/ship metricbeat logs..?  
Or am I supposed to use separate users for log collecting and log shiping tasks..?

Regards  
Raul

---

<div class="post-metadata">

**Author:** ![raulk89](https://avatars.discourse-cdn.com/v4/letter/r/2bfe46/32.png) [@raulk89](https://discuss.elastic.co/u/raulk89)\
**Post date:** [November 30, 2021, 7:16am UTC](https://discuss.elastic.co/t/action-indices-admin-rollover-is-unauthorized-for-user-remote-monitoring-user-with-roles/288481/2 "2021-11-30T07:16:09Z")

</div>

Anyone ?

Thanks  
Raul

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2021, 7:16am UTC](https://discuss.elastic.co/t/action-indices-admin-rollover-is-unauthorized-for-user-remote-monitoring-user-with-roles/288481/3 "2021-12-28T07:16:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.