# \[indices:admin/create\] is unauthorized for user Elastic Stack

**URL:** https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767
**Category:** Beats
**Tags:** elastic-stack-security, filebeat
**Created:** [November 30, 2025, 5:04am UTC](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767 "2025-11-30T05:04:12Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [November 30, 2025, 6:23am UTC](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767/2 "2025-11-30T06:23:43Z")

</div>

Hi @frahmn Welcome to the community

I think perhaps you're confusing a few topics.

First, the article you listed below has nothing to do with the API keys and filebeat.

That article refers to the user that Kibana uses to connect with Elasticsearch. In previous versions. You could use the `elastic` user but that's no longer an option.

So let's put that aside

Please always include the version of the stack you are working with... So what version are you on?

Now you should just log in as the `elastic` user and create the filebeat writer API key as defined in the documentation.

> **[Grant access using API keys | Beats](https://www.elastic.co/docs/reference/beats/filebeat/beats-api-keys)**
>
> Instead of using usernames and passwords, you can use API keys to grant access to Elasticsearch resources. You can set API keys to expire at a certain...

Then please show us how you're configuring file be with this API key...

And what command are you running when you get that error.

Were you running `setup`?  
Or just trying to start filebeat.

If you created a new user with no roles that will probably not work as an API key is an intersection of the roles of the users that created it with the roles defined in the API key. I just wrote this up in another [topic](https://discuss.elastic.co/t/api-key-does-or-does-not-rely-on-permissions-from-user-that-created-it/383663/4)..

So log in with the `elastic` user and create the API key

Show us the versions  
Show us the configuration  
Show us the command you're running  
And the result

---

_[View the full topic](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767)._