# Cannot create Data Stream

**URL:** <https://discuss.elastic.co/t/cannot-create-data-stream/256621>\
**Category:** Kibana\
**Created:** [November 25, 2020, 9:05am UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621 "2020-11-25T09:05:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Angelos](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Angelos](https://discuss.elastic.co/u/Angelos)\
**Post date:** [November 25, 2020, 9:05am UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621/1 "2020-11-25T09:05:33Z")

</div>

Hi,

I am trying to create Data Streams by issuing:  
`PUT _data_stream/test-index-pattern`  
but I have this error:

```auto
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "action [indices:admin/data_stream/create] is unauthorized for user [elastic]"
      }
    ],
    "type" : "security_exception",
    "reason" : "action [indices:admin/data_stream/create] is unauthorized for user [elastic]",
    "caused_by" : {
      "type" : "illegal_state_exception",
      "reason" : "There are no external requests known to support wildcards that don't support replacing their indices"
    }
  },
  "status" : 403
}

```

How can I fix that?

Thank you in advance!

/Angelos

---

<div class="post-metadata">

**Author:** ![Dzmitry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dzmitry/32/65026_2.png) [@Dzmitry](https://discuss.elastic.co/u/Dzmitry)\
**Post date:** [November 25, 2020, 3:34pm UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621/2 "2020-11-25T15:34:13Z")

</div>

Hi @Angelos,

Based on error it looks like your user does not have a permission to write data stream. You can check the [docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/securing-aliases.html) to better understand permissions.

You can update user permission in Stack Management -\> Security -\> Users

Regards, Dzmitry

---

<div class="post-metadata">

**Author:** ![Angelos](https://avatars.discourse-cdn.com/v4/letter/a/4bbf92/32.png) [@Angelos](https://discuss.elastic.co/u/Angelos)\
**Post date:** [November 30, 2020, 8:55am UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621/3 "2020-11-30T08:55:13Z")

</div>

Hi Dzmitry,

Thank you for your response.

> [@Dzmitry](#):
>
> Based on error it looks like your user does not have a permission to write data stream

As you can see from the error I am using the default elastic user which is `superuser`.

/Angelos

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [December 4, 2020, 5:15pm UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621/4 "2020-12-04T17:15:25Z")

</div>

Hi how did you set up your super user - elastic? What is the version of your stack?

Thanks!  
Bhavya

---

<div class="post-metadata">

**Author:** ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)\
**Post date:** [December 4, 2020, 5:25pm UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621/5 "2020-12-04T17:25:52Z")

</div>

The authorization error you're seeing is likely a red herring, and not the actual cause of your problem: [https://github.com/elastic/elasticsearch/issues/61245](https://github.com/elastic/elasticsearch/issues/61245)

Can you provide the command you used to create the `test-index-pattern` index template?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 1, 2021, 5:26pm UTC](https://discuss.elastic.co/t/cannot-create-data-stream/256621/6 "2021-01-01T17:26:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.