Search guard configuration question

Elastic Stack Elasticsearch
1

hello everyone,

i am attempting to run search guard with elastic search but no matter what I have tried from the suggestions I found while googling I could not solve it. So i decided to ask here.

Here is the error i receive

elasticsearch_1 | [2019-03-12T12:09:26,517][INFO ][c.f.s.p.PrivilegesEvaluator] [qQekPb0] No index-level perm match for User [name=logstash, roles=[logstash], requestedTenant=null] Resolved [aliases=, indices=[my_index], allIndices=[my_index], types=, isAll()=false, isEmpty()=false] [Action [indices:admin/create]] [RolesChecked [sg_own_index, sg_logstash]]
elasticsearch_1 | [2019-03-12T12:09:26,523][INFO ][c.f.s.p.PrivilegesEvaluator] [qQekPb0] No permissions for [indices:admin/create]
logstash_1 | [2019-03-12T12:09:26,739][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"security_exception", "reason"=>"no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]"})
logstash_1 | [2019-03-12T12:09:26,741][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"security_exception", "reason"=>"no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]"})
logstash_1 | [2019-03-12T12:09:26,744][INFO ][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({"type"=>"security_exception", "reason"=>"no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]"})
logstash_1 | [2019-03-12T12:09:26,744][INFO ][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>3}
https://pastebin.com/raw/FEXS0KAZ

logstash.conf -> https://pastebin.com/raw/RpseY5Et
filebeat.yml -> https://pastebin.com/raw/7Zm869Ww
sg_roles.yml -> https://pastebin.com/raw/vmV2kuE8

any ideas what it might be wrong?

2

Please don't post images of text as they are hard to read, may not display
correctly for everyone, and not searchable.

Instead paste the text and format it with </> icon, and check the preview
window to make sure it's properly formatted before posting it. This makes it
more likely that your question will receive a useful answer.

It would be great if you could update your post to solve this.

Also, since SearchGuard is a 3rd party plugin, you might get help quicker by engaging with them (maybe an issue in their Github repo, or any public forums they maintain) or other users that use that plugin

2 Likes
3

thank you for the information,
I have updated the post

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.