Invalid index name [_security], must not start with '_', '-', or '+'

Also, in 6.3, the API endpoint was different : https://www.elastic.co/guide/en/elasticsearch/reference/6.3/security-api-put-user.html

But as @dadoonet said, do update to a recent version please