# Custom User couldn't write logs to Elastic

**URL:** https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [June 24, 2019, 2:01pm UTC](https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150 "2019-06-24T14:01:14Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![KatiukOleg](https://avatars.discourse-cdn.com/v4/letter/k/6bbea6/32.png) [@KatiukOleg](https://discuss.elastic.co/u/KatiukOleg)
#### Post date: [June 24, 2019, 2:01pm UTC](https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150/1 "2019-06-24T14:01:14Z")

</div>

Hi there,

I was creating custom user via Kibana for writing logs to elastic purpose only.  
Firstly I specify custom role -\>

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/5/f57defd88b011e3fbf1b7efb9a6eb21364fd431f.png)  
Then I map new user with this role.

Then I tried my C# app in debug mode and no logs are added.  
When I did the same with elastic user, logs are added properly.

Could you advise how can I fix it?  
Best Regards, Oleg

---

<div class="post-metadata">

### Author: ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)
#### Post date: [June 24, 2019, 2:56pm UTC](https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150/2 "2019-06-24T14:56:17Z")

</div>

> [@KatiukOleg](#):
>
> C# app in debug mode and no logs are added.

Am not too sure about C# app ..can you throw more light on it . Is that a third party tool ?

also I have pinged @Larry_Gregory for more insights

---

<div class="post-metadata">

### Author: ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)
#### Post date: [June 24, 2019, 2:58pm UTC](https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150/3 "2019-06-24T14:58:10Z")

</div>

@KatiukOleg,

Can you share the response that you get from Elasticsearch when you try to write these logs? Elasticsearch should give you an explanation of why the operation failed, which will help us diagnose this.

---

<div class="post-metadata">

### Author: ![KatiukOleg](https://avatars.discourse-cdn.com/v4/letter/k/6bbea6/32.png) [@KatiukOleg](https://discuss.elastic.co/u/KatiukOleg)
#### Post date: [June 24, 2019, 3:25pm UTC](https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150/4 "2019-06-24T15:25:47Z")

</div>

I checked access to ElasticSearch with elastic and my custom user credentials via this command in K8s elasticsearch pod -\>  
curl -u [any user] '[http://azure-elasticsearch-prod:9200](http://azure-elasticsearch-prod:9200)' and get the same response:

```auto
{
  "name" : "azure-elasticsearch-prod-0",
  "cluster_name" : "docker-cluster",
  "cluster_uuid" : "kGL6IWb3Rgug-bcnOxO90Q",
  "version" : {
    "number" : "7.1.1",
    "build_flavor" : "default",
    "build_type" : "docker",
    "build_hash" : "7a013de",
    "build_date" : "2019-05-23T14:04:00.380842Z",
    "build_snapshot" : false,
    "lucene_version" : "8.0.0",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "You Know, for Search"
}

```

What about logs - I used this command - 'kubectl logs -f my-pod' and there was nothing that can be mapped with my user activity. May be there is another place where I can look through the logs?

Oleg

---

<div class="post-metadata">

### Author: ![Larry\_Gregory](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larry_gregory/32/34969_2.png) [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)
#### Post date: [June 24, 2019, 3:40pm UTC](https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150/5 "2019-06-24T15:40:45Z")

</div>

Thanks for the additional information. What response does your c# application get from Elasticsearch when you try to write the logs?

Is the application writing to an existing index, or is the application supposed to create its own index? If it's creating its own index, then you'll also need to grant the `create_index` index privilege. See [https://www.elastic.co/guide/en/elastic-stack-overview/current/security-privileges.html](https://www.elastic.co/guide/en/elastic-stack-overview/current/security-privileges.html) for an explanation of available privileges

---

<div class="post-metadata">

### Author: ![KatiukOleg](https://avatars.discourse-cdn.com/v4/letter/k/6bbea6/32.png) [@KatiukOleg](https://discuss.elastic.co/u/KatiukOleg)
#### Post date: [June 24, 2019, 3:54pm UTC](https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150/6 "2019-06-24T15:54:26Z")

</div>

Larry, adding 'create\_index' helps me.

And I think i need review my app. Add some try-catch block while connecting to elasticsearch.

Thanks a lot!

Oleg

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 22, 2019, 3:54pm UTC](https://discuss.elastic.co/t/custom-user-couldnt-write-logs-to-elastic/187150/7 "2019-07-22T15:54:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
