# Filebeats ILM permission error

**URL:** <https://discuss.elastic.co/t/filebeats-ilm-permission-error/214617>\
**Category:** Beats\
**Tags:** elastic-stack-security, ilm-index-lifecycle-management\
**Created:** [January 10, 2020, 3:11pm UTC](https://discuss.elastic.co/t/filebeats-ilm-permission-error/214617 "2020-01-10T15:11:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![trunet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trunet/32/60635_2.png) [@trunet](https://discuss.elastic.co/u/trunet)\
**Post date:** [January 10, 2020, 3:11pm UTC](https://discuss.elastic.co/t/filebeats-ilm-permission-error/214617/1 "2020-01-10T15:11:03Z")

</div>

Hello,

Just finished configuring elasticsearch, filebeat and kibana with SSL, xpack security and ILM.

Issue is that after following [https://www.elastic.co/guide/en/beats/filebeat/current/feature-roles.html](https://www.elastic.co/guide/en/beats/filebeat/current/feature-roles.html) and creating filebeat\_admin user:

I have errors when rollover happens:  
Index lifecycle error  
security\_exception: action [indices:admin/settings/update] is unauthorized for user [filebeat\_admin]

Which role should give this permission to assign to the user?

---

<div class="post-metadata">

**Author:** ![trunet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trunet/32/60635_2.png) [@trunet](https://discuss.elastic.co/u/trunet)\
**Post date:** [January 13, 2020, 8:39am UTC](https://discuss.elastic.co/t/filebeats-ilm-permission-error/214617/2 "2020-01-13T08:39:21Z")

</div>

anyone?

---

<div class="post-metadata">

**Author:** ![trunet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trunet/32/60635_2.png) [@trunet](https://discuss.elastic.co/u/trunet)\
**Post date:** [January 13, 2020, 9:22am UTC](https://discuss.elastic.co/t/filebeats-ilm-permission-error/214617/3 "2020-01-13T09:22:13Z")

</div>

This is the full error:

```
[2020-01-13T09:20:06,143][INFO][o.e.x.i.IndexLifecycleRunner] [elasticsearchp004.[REDACTED]] moving index [filebeat-7.5.1-2020.01.02-000004] from [{"phase":"warm","action":"set_priority","name":"ERROR"}] to [{"phase":"warm","action":"set_priority","name":"set_priority"}] in policy [filebeat-7.5.1]
[2020-01-13T09:20:06,215][ERROR][o.e.x.i.IndexLifecycleRunner] [elasticsearchp004.[REDACTED]] policy [filebeat-7.5.1] for index [filebeat-7.5.1-2020.01.02-000004] failed on step [{"phase":"warm","action":"set_priority","name":"set_priority"}]. Moving to ERROR step

```

roles.yml:

```
filebeat_setup:
  cluster:
  - monitor
  - manage_ilm
  - manage_ml
  indices:
  - names: filbeat-*
    privileges:
    - indices:admin/settings/update
    - manage
    - read
  - names: shrink-filbeat-*
    privileges:
    - indices:admin/settings/update
    - manage
    - read
filebeat_writer:
  cluster:
  - monitor
  - read_ilm
  - cluster:admin/ingest/pipeline/get
  indices:
  - names: filebeat-*
    privileges:
    - create_doc
    - view_index_metadata
    - create_index
  - names: shrink-filebeat-*
    privileges:
    - create_doc
    - view_index_metadata
    - create_index

```

filebeat\_admin user have the following roles:

```
filebeat_setup
filebeat_writer
kibana_user
ingest_admin
beats_admin
```

---

<div class="post-metadata">

**Author:** ![trunet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trunet/32/60635_2.png) [@trunet](https://discuss.elastic.co/u/trunet)\
**Post date:** [January 13, 2020, 10:01am UTC](https://discuss.elastic.co/t/filebeats-ilm-permission-error/214617/4 "2020-01-13T10:01:30Z")

</div>

Well, there was a typo... I had filbeat-\* instead of filebeat-\*.

I also had to add the shrink-filebeat-\* index privilege as my ILM policy also shrinks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 10, 2020, 12:09pm UTC](https://discuss.elastic.co/t/filebeats-ilm-permission-error/214617/5 "2020-02-10T12:09:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.