Security Exception with data/write/bulk


I am trying to run logstash pipeline and getting below exception

13:10:00.102 [[main]>worker0] WARN logstash.outputs.elasticsearch - Failed action. {:status=>403, :action=>["index", {:_id=>"notifyuserprofile-webservice-pega", :_index=>"myindex", :_type=>"inventory", :_routing=>nil}, 2016-12-21T18:10:00.051Z %{host} %{message}], :response=>{"index"=>{"_index"=>"myindex", "_type"=>"xxxx", "_id"=>"12345", "status"=>403, "error"=>{"type"=>"security_exception", "reason"=>" myindex[indices:data/write/bulk[s]] is unauthorized for user [logstash_internal]"}}}}


and updated roles for user logstash_internal

"logstash_writer": {
"cluster": [
"indices": [
"names": [
"privileges": [
"run_as": [],
"metadata": {}

appreciate any help here

(Mark Walkom) #2

But you've only allowed;


sorry i corrected my data above, the index is myindex only

(Mark Walkom) #4

There's still a difference between what you are setting and what it's using.


let me know what difference you see i can provide any settings

(Mark Walkom) #6



its working now, . i had logstash*. as indices privileges in the admin console when i configured the logstash writer,i updated the indices privileges to "myindex"

(system) #8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.