# Security\_exception in logstash log: indices:admin/auto\_create is unauthorized for user
**URL:** https://discuss.elastic.co/t/security-exception-in-logstash-log-indices-admin-auto-create-is-unauthorized-for-user/269523
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [April 7, 2021, 8:21pm UTC](https://discuss.elastic.co/t/security-exception-in-logstash-log-indices-admin-auto-create-is-unauthorized-for-user/269523 "2021-04-07T20:21:13Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@cotjoey](https://discuss.elastic.co/u/cotjoey)
#### Post date: [April 7, 2021, 8:21pm UTC](https://discuss.elastic.co/t/security-exception-in-logstash-log-indices-admin-auto-create-is-unauthorized-for-user/269523/1 "2021-04-07T20:21:13Z")
Hello,
I configured fluentd to forward logs to Logstash (7.10) and the Elasticsearch output throws the following error:
```auto
[2021-04-07T17:17:11,390][INFO][logstash.outputs.elasticsearch][main][2662b9682e97be5de9346f00d190e82e317c2c2078c5cf5de05e3d5114ff1081] retrying failed action with response code: 403 ({"type"=>"security_exception", "reason"=>"action [indices:admin/auto_create] is unauthorized for user [logstash_internal]"})
[2021-04-07T17:17:11,391][INFO][logstash.outputs.elasticsearch][main][2662b9682e97be5de9346f00d190e82e317c2c2078c5cf5de05e3d5114ff1081] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=>1}
```
My user "logstash\_internal" has been assigned a role. That role has privileges, but "indices:admin/auto\_create" is not one that is available to assign to it.
Can anyone help me find which permission I need to assign to my role? I tried "auto\_configure", but that didn't work.
Thank you for your help,
Joey
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [April 8, 2021, 1:55am UTC](https://discuss.elastic.co/t/security-exception-in-logstash-log-indices-admin-auto-create-is-unauthorized-for-user/269523/2 "2021-04-08T01:55:22Z")
> [@cotjoey](#):
>
> I tried "auto\_configure", but that didn't work.
`auto_configure` should work. What went wrong?
---
### Author:  [@cotjoey](https://discuss.elastic.co/u/cotjoey)
#### Post date: [April 8, 2021, 9:56am UTC](https://discuss.elastic.co/t/security-exception-in-logstash-log-indices-admin-auto-create-is-unauthorized-for-user/269523/3 "2021-04-08T09:56:08Z")
The same exact error showed up in the logs:
`action [indices:admin/auto_create] is unauthorized for user [logstash_internal]`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 6, 2021, 9:56am UTC](https://discuss.elastic.co/t/security-exception-in-logstash-log-indices-admin-auto-create-is-unauthorized-for-user/269523/4 "2021-05-06T09:56:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.