Kibana Alerting won't create specified index

Hi, my problem is that when I set-up alerting using index alerting connector, no index gets created when alerts trigger. Could someone please help and write down the steps needed to set-up Kibana alerting to write to a specified index? I want to have a specific index just for Kibana alerts. Thank you.

Steps I took:

  1. Create an Index Connector. Set it to write to "alerts" index which does not currently exist.
  2. Create new alert and set it to use the created Index Connector from step 1.
  3. Before saving the test Alert, check whether the alert would get triggered by watching the dynamic graph and enter some message in the "Document to index" field.
  4. Save alert and make sure it's enabled.

After all this steps, I can't see any new index getting created. Thanks in advance.

Hi, I am guessing that you have Elastic Security enabled, and the user that created the Index Action Connector has limited privileges and perhaps doesn't have the necessary privileges. Are you able to see any errors in the Kibana server logs?

If that is the problem happening, here are the steps:

  1. Have a superuser create a role that allows a user to write to an index called alerts
  2. Add that role to the user that you test with
  3. Log into Kibana with the original test user that now has that role
  4. Create the Index Connector and set it to write to alerts

When you create the index connector, Kibana generates an API key to read and write info in Elasticsearch. The key carries the same credentials that the test user has, so it can't be used to perform actions that otherwise aren't going to be allowed to the user.