Security Exception with data/write/bulk

Elastic Stack Logstash
1

I am trying to run logstash pipeline and getting below exception

13:10:00.102 [[main]>worker0] WARN logstash.outputs.elasticsearch - Failed action. {:status=>403, :action=>["index", {:_id=>"notifyuserprofile-webservice-pega", :_index=>"myindex", :_type=>"inventory", :_routing=>nil}, 2016-12-21T18:10:00.051Z %{host} %{message}], :response=>{"index"=>{"_index"=>"myindex", "_type"=>"xxxx", "_id"=>"12345", "status"=>403, "error"=>{"type"=>"security_exception", "reason"=>" myindex[indices:data/write/bulk[s]] is unauthorized for user [logstash_internal]"}}}}

followed Logstash Reference [8.11] | Elastic

and updated roles for user logstash_internal

{
"logstash_writer": {
"cluster": [
"manage_index_templates",
"monitor",
"all",
"manage",
"manage_security"
],
"indices": [
{
"names": [
"myindex-*"
],
"privileges": [
"write",
"delete",
"create_index",
"create",
"all"
]
}
],
"run_as": ,
"metadata": {}
}
}

appreciate any help here

2

But you've only allowed;

3

sorry i corrected my data above, the index is myindex only

4

There's still a difference between what you are setting and what it's using.

5

let me know what difference you see i can provide any settings

6

^^^^

7

its working now, . i had logstash*. as indices privileges in the admin console when i configured the logstash writer,i updated the indices privileges to "myindex"

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.