# How do I protect indexes **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [January 17, 2022, 12:44pm UTC](https://discuss.elastic.co/t/how-do-i-protect-indexes/294585 "2022-01-17T12:44:04Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![kzltp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kzltp/32/100406_2.png) [@kzltp](https://discuss.elastic.co/u/kzltp)\ **Post date:** [January 17, 2022, 12:44pm UTC](https://discuss.elastic.co/t/how-do-i-protect-indexes/294585/1 "2022-01-17T12:44:04Z")
I use elasticsarch 7.16. I wanna any indexes not delete. Any user(included in superuser) can't delete any indexes. How do i do that. ---
**Author:** ![FALEN](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/falen/32/82754_2.png) [@FALEN](https://discuss.elastic.co/u/FALEN)\ **Post date:** [January 17, 2022, 1:03pm UTC](https://discuss.elastic.co/t/how-do-i-protect-indexes/294585/2 "2022-01-17T13:03:45Z")
Hi, you cant stop superusers from deleting indices, there are workarounds for regular users stack management-\>roles-\> - there is delete privileges you can remove from spesific role ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3aa1b910e412c0d30dc253005732a0a869f9f400.png) to disable delete api you can use nginx or smth like that to block it in CORS > Access-Control-Allow-Methods: OPTIONS, POST, GET, PUT > Access-Control-Allow-Headers: X-Requested-With, Content-Type, > Content-Length And this one can help you stop bulk deleting > action.destructive\_requires\_name: true ---
**Author:** ![kzltp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kzltp/32/100406_2.png) [@kzltp](https://discuss.elastic.co/u/kzltp)\ **Post date:** [January 17, 2022, 2:04pm UTC](https://discuss.elastic.co/t/how-do-i-protect-indexes/294585/3 "2022-01-17T14:04:05Z")
I configured xpack and i use filebeat. When i set less role, filebeat can't start. That's way, i must add create\_doc,create,delete,index,write role. 2022-01-17T17:00:09.972659+03:00 VTNOVWEBAPA01 auditbeat[29941]: 2022-01-17T17:00:09.971+0300#011WARN#011[Elasticsearch]#011elasticsearch/client.go:414#011Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Date(2022, time.January, 17, 14, 0, 8, 966745353, time.UTC), Meta:null, Fields:{"agent":{"ephemeral\_id":"80375794-75d2-4ed9-a853-bf81c2daa4da","hostname":"[VTNOVWEBAPA01.i01.paytr.com](http://VTNOVWEBAPA01.i01.paytr.com)","id":"99a84502-33db-4843-9105-fdb004b7f000","name":"[VTNOVWEBAPA01.i01.paytr.com](http://VTNOVWEBAPA01.i01.paytr.com)","type":"auditbeat","version":"7.16.2"},"client":{"bytes":76,"ip":"10.30.40.15","packets":1,"port":123},"destination":{"bytes":84,"ip":"10.30.14.2","packets":1,"port":123},"ecs":{"version":"1.12.0"},"event":{"action":"network\_flow","category":["network","network\_traffic"],"dataset":"socket","duration":630753,"end":"2022-01-17T13:59:38.924Z","kind":"event","module":"system","start":"2022-01-17T13:59:38.924Z","type":["info","connection"]},"flow":{"complete":false,"final":true},"group":{"id":"112","name":"ntp"},"host":{"architecture":"x86\_64","containerized":false,"hostname":"[VTNOVWEBAPA01.i01.paytr.com](http://VTNOVWEBAPA01.i01.paytr.com)","id":"e34a4a94e7584673afc27251b60742a3","ip":["10.30.40.15","fe80::250:56ff:fea0:9e9b"],"mac":["00:50:56:a0:9e:9b"],"name":"[VTNOVWEBAPA01.i01.paytr.com](http://VTNOVWEBAPA01.i01.paytr.com)","os":{"codename":"buster","family":"debian","kernel":"4.19.0-16-amd64","name":"Debian GNU/Linux","platform":"debian","type":"linux","version":"10 (buster)"}},"network":{"bytes":160,"community\_id":"1:c7ht7iRX+XCigpp/+9/80jiNH84=","direction":"egress","packets":2,"transport":"udp","type":"ipv4"},"process":{"args":["/usr/sbin/ntpd","-p","/var/run/ntpd.pid","-g","-u","106:112"],"created":"2021-10-22T22:39:15.800Z","executable":"/usr/sbin/ntpd","name":"ntpd","pid":612},"related":{"ip":["10.30.40.15","10.30.14.2"],"user":["ntp"]},"server":{"bytes":84,"ip":"10.30.14.2","packets":1,"port":123},"service":{"type":"system"},"source":{"bytes":76,"ip":"10.30.40.15","packets":1,"port":123},"system":{"audit":{"socket":{"egid":112,"euid":106,"gid":112,"kernel\_sock\_address":"0xffff9d167b328000","uid":106}}},"user":{"id":"106","name":"ntp"}}, Private:interface {}(nil), TimeSeries:true}, Flags:0x0, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=403): {"type":"security\_exception","reason":"action [indices:data/write/bulk[s]] is unauthorized for user [collector\_user] with roles [collector\_writer,kibana\_admin,beats\_system] on indices [auditbeat-7.16.2], this action is granted by the index privileges [create\_doc,create,delete,index,write,all]"}, dropping event! ---
**Author:** ![kzltp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kzltp/32/100406_2.png) [@kzltp](https://discuss.elastic.co/u/kzltp)\ **Post date:** [January 17, 2022, 2:09pm UTC](https://discuss.elastic.co/t/how-do-i-protect-indexes/294585/4 "2022-01-17T14:09:41Z")
And. I tried http.cors. When i set http.cors without DELETE method. Kibana cannot connect. Kibana wanna DELETE method. I tried every your suggestion. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 14, 2022, 2:10pm UTC](https://discuss.elastic.co/t/how-do-i-protect-indexes/294585/5 "2022-02-14T14:10:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.