# "reset" ILM failed step **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, ilm-index-lifecycle-management\ **Created:** [March 15, 2023, 1:09pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754 "2023-03-15T13:09:14Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![pestevao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pestevao/32/44138_2.png) [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Post date:** [March 15, 2023, 1:09pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/1 "2023-03-15T13:09:14Z")
Hello, I've some restricted indices stuck on ILM actions because of permissions. `security_exception: action [indices:admin/delete] is unauthorized for user [xxx] with roles [superuser] on restricted indices [.ds-.fleet-actions-results-2022.09.16-000001], this action is granted by the index privileges [delete_index,manage,all]` Some other displays set\_priority. I don't even know how the indices became on this state. Maybe some testing (and terribly failing!) on ILM for these indices. I don't want to delete them, just solve this issue that is occuring everytime "ILM cron" runs (so everytime). I've tried to restore them from a previous snapshot but they are restricted indices so the same protection came in place and I'm unable to restore them. Thank you, Pedro ---
**Author:** ![jba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jba/32/118482_2.png) [@jba](https://discuss.elastic.co/u/jba)\ **Post date:** [March 18, 2023, 7:16pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/2 "2023-03-18T19:16:11Z")
Do the superuser role on your system include the mentioned index privileges? ---
**Author:** ![pestevao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pestevao/32/44138_2.png) [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Post date:** [March 23, 2023, 3:12pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/3 "2023-03-23T15:12:28Z")
Yes. This user is "Global / Super" admin. The question is these are restricted indices as stated in the error output. They are supposed to not be manipulated by any kind of user despite their privileges. And I don't know how they have been caught (wrongly) on this ILM... ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [March 24, 2023, 3:05am UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/4 "2023-03-24T03:05:48Z")
The `.ds-.fleet-actions-results-2022.09.16-000001` index is a backing index of the `.fleet-actions-results` system data stream. It should only be managed by the `elastic/fleet-server` service account internally. I suggest you remove this index/datastream from the ILM policy that encountered this error. ---
**Author:** ![pestevao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pestevao/32/44138_2.png) [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Post date:** [March 24, 2023, 7:39pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/5 "2023-03-24T19:39:05Z")
We've already done that. But how to clear the ILM stage error? ---
**Author:** ![jba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jba/32/118482_2.png) [@jba](https://discuss.elastic.co/u/jba)\ **Post date:** [March 30, 2023, 7:37pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/6 "2023-03-30T19:37:20Z")
Do you know who created (or last modified) the ILM policy that is assigned to this '.ds-.fleet-actions-results-2022.09.16-000001' index? I have a suspicion that any actions that a policy specify is carried out with the privileges of whoever created/modified the policy. As for clearing the error, have you tried opening up the index in the Kibana Index Management view, and clicked Manage Index -\> Retry Policy (bottom right corner)? I don't know if it will do anything. Otherwise, check if the index has an alias (.ds-.fleet-actions-results)? If so, try deleting the ILM Policy from the index (same button), and then add it again. ---
**Author:** ![pestevao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pestevao/32/44138_2.png) [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Post date:** [March 31, 2023, 3:23pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/7 "2023-03-31T15:23:55Z")
Thanks for your feedback @jba. I've tried to make "Remove policy" and the error message is similar than the error that the ILM Delete phase register in logs: `403: Forbidden. action [indices:admin/ilm/remove_policy] is unauthorized for user [XXXXXX] with effective roles [superuser] on restricted indices [.ds-.fleet-actions-results-000001], this action is granted by the index privileges [manage_ilm,manage,all]` So it seems that like this is a restricted indice, elastic doesn't allow to make any kind of action on it ([Defining roles | Elasticsearch Guide [8.7] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv)). I understand the reasons why we shouldn't delete them but keep this error going on and on and on is insane! The affected ILM is already correct and the failed step removed from it. Should have a way to clear the ILM failed step thought. ---
**Author:** ![pestevao](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pestevao/32/44138_2.png) [@pestevao](https://discuss.elastic.co/u/pestevao)\ **Post date:** [April 18, 2023, 3:40pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/8 "2023-04-18T15:40:44Z")
Final solution at last! Have created a new (user) Role with "allow\_restricted\_indices": true permission and "all" on the restricted indice, like this: ```auto POST /_security/role/_temp_restricted_indice_permission { "indices": [ { "names": [".restricted-indice-name"], "privileges": ["all"], "allow_restricted_indices": true } ] } ``` Then go to Kibana -\> Management -\> Users and give this role to your user. Next go to Kibana -\> Management -\> Index Management, filter by indices with errors, go to detail to each one of the indices and click "Manage ^" -\> "Remove lifecycle policy" like shown bellow: ![imagem](https://us1.discourse-cdn.com/elastic/original/3X/7/7/77f6e81b4a63acc18314a5ef3473074b1648d7ac.png) Solve this issue, no more indices with errors and no restricted indices or system configuration / information was affected! 🙂 Thank you all for your inputs and shared ideas. Greetings, Pedro P.S. - maybe just manage\_ilm or manage permissions on (user) Role catching the restricted indice will do the job but... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 16, 2023, 3:41pm UTC](https://discuss.elastic.co/t/reset-ilm-failed-step/327754/9 "2023-05-16T15:41:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.