# Kibana\_system privileges - unauthorized for user \[kibana\_system\] with roles \[kibana\_system\] on indices

**URL:** <https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [April 28, 2022, 11:32am UTC](https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505 "2022-04-28T11:32:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Penchev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/penchev/32/100328_2.png) [@Penchev](https://discuss.elastic.co/u/Penchev)\
**Post date:** [April 28, 2022, 11:32am UTC](https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505/1 "2022-04-28T11:32:43Z")

</div>

Hi,

I changed the deprecated user kibana to kibana\_system and now I have this error.

> `{"type":"log","@timestamp":"2022-04-28T02:45:00-04:00","tags":["error","plugins","wazuh","monitoring"],"pid":29306,"message":"security_exception: [security_exception] Reason: action [indices:admin/settings/update] is unauthorized for user [kibana_system] with roles [kibana_system] on indices [wazuh-monitoring-2022.04], this action is granted by the index privileges [manage,all]"}`

The user kibana\_system is locked for any changes. How can I grant those privileges?

Best Regards,  
Petar

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [May 5, 2022, 1:37pm UTC](https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505/2 "2022-05-05T13:37:39Z")

</div>

Documentation for adding/updating roles can be found here:

> **[Create or update roles API | Elasticsearch Guide \[8.2\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role.html)**

You can use Kibana Stack Management application to perform the changes on roles as well.

> **[Kibana role management | Kibana Guide \[8.2\] | Elastic](https://www.elastic.co/guide/en/kibana/current/kibana-role-management.html)**
>
> Conceptual and step-by-step procedures for using runtime fields, scripted fields, and field formatters.

I usually have this at hand though (adapt accordingly):

```auto
curl -k --user "${ES_USER}:${ES_PASSWORD}" -X POST \
 -H "Content-Type: application/json" \
 -d '{"cluster":[],"indices":[],"applications":[]}' \
  "https://${ES_HOST}:${ES_PORT}/_security/role/${ROLE}"
```

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [May 6, 2022, 12:30am UTC](https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505/3 "2022-05-06T00:30:52Z")

</div>

The `kibana_system` user is meant to be used only by the Kibana application (i.e. configured in `kibana.yml` file) for system communication. It should not be used by other applications or interactive usages. Depending on your exact use case, but you most likely need to create a new user and grant relevant privileges.

---

<div class="post-metadata">

**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\
**Post date:** [May 6, 2022, 3:01pm UTC](https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505/4 "2022-05-06T15:01:23Z")

</div>

Yup, sorry @Penchev but @Yang_Wang is totally right 🤦‍♂️

![](https://us1.discourse-cdn.com/elastic/original/3X/3/3/330635ef7b97f4767cec59d559387182a3e085eb.gif)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2022, 3:02pm UTC](https://discuss.elastic.co/t/kibana-system-privileges-unauthorized-for-user-kibana-system-with-roles-kibana-system-on-indices/303505/5 "2022-06-03T15:02:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.