I posted about this too, when I try to manually change for a single index
curl -XPUT -k -u elastic:$pass https://192.168.131.155:9200/.ds-.fleet-actions-results-2022.03.22-000002/_settings -d '{"logs-*": {"number_of_replicas": "0"}}' -H 'Content-Type: application/json'
{"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:admin/settings/update] is unauthorized for user [elastic] with roles [superuser] on restricted indices [.ds-.fleet-actions-results-2022.03.22-000002], this action is granted by the index privileges [manage,all]"}],"type":"security_exception","reason":"action [indices:admin/settings/update] is unauthorized for user [elastic] with roles [superuser] on restricted indices [.ds-.fleet-actions-results-2022.03.22-000002], this action is granted by the index privileges [manage,all]"},"status":403}
I've created an index template, but now I can't delete that either, since it's in use
In the past I would just modify the pattern and save, then delete but can't do that here
curl -XGET -k -u elastic:$pass https://localhost:9200/_index_template/.fleet-actions-results?pretty
{
"index_templates" : [
{
"name" : ".fleet-actions-results",
"index_template" : {
"index_patterns" : [
".fleet-actions-results*"
],
"template" : {
"settings" : {
"index" : {
"number_of_replicas" : "0"
}
}
},
"composed_of" : [ ],
"priority" : 90000001,
"_meta" : {
"description" : "Test"
},
"data_stream" : {
"hidden" : false,
"allow_custom_routing" : false
}
}
}
]
}