Logstash retrying failed action ... "reason"=>"action [indices:admin/create] is unauthorized for user logstash_writer

Elastic Stack Elasticsearch
1

Hi,

I have the following lines in my logstash logs:

Dec 11 14:09:01 EAGLEEYE-A3001 logstash: [2019-12-11T14:09:01,149][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"security_exception", "reason"=>"action [indices:admin/create] is unauthorized for user [logstash_writer]"})
Dec 11 14:09:01 EAGLEEYE-A3001 logstash: [2019-12-11T14:09:01,149][INFO ][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>1}

I don't find the needed permission to grant to the role the user has.

With the role superuser everything works.

I have set the following privileges to logstash_writer:

image
image.png1042×813 38 KB

I am thankfulfor every advise.

Best regards,
Robert

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.