# Status=403): {"type":"security\_exception","reason":"action \[indices:data/write/bulk\[s\]

**URL:** <https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299>\
**Category:** Beats\
**Tags:** elastic-stack-security, metricbeat\
**Created:** [July 8, 2020, 8:30am UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299 "2020-07-08T08:30:06Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmk1995](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Post date:** [July 8, 2020, 8:30am UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/1 "2020-07-08T08:30:06Z")

</div>

Hello,

It took me the whole day and I still cant work it out.  
Please see below what is wrong

My Kibana user setting:

 ![temp](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21d6e2ed8235d9271d4dc0e96ffa0a1fb79f1142.png)

metricbeat.yml:

```
metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.name: "metricbeat"
setup.template.pattern: "metricbeat-*"
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
setup.kibana:
  host: "xxxxxxx:5601"
setup.ilm.check_exists: false
output.elasticsearch:
  hosts: ["xxxxxxx:9200"]
  index: "metricbeat-%{[agent.version]}-%{+yyyy.MM.dd}"
  protocol: "https"
  username: "metricbeat_writer"
  password: "xxxxxxxxxxxxxx"

  ssl.certificate_authorities: ["/etc/logstash/elasticsearch-ca.pem"]
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~
monitoring.enabled: true

```

Error:

> Jul 8 16:26:45 ls02 metricbeat: 2020-07-08T16:26:45.021+0800#011WARN#011elasticsearch/client.go:266#011monitoring bulk item insert failed (i=0, status=403): {"type":"security\_exception","reason":"action [indices:data/write/bulk[s]] is unauthorized for user [metricbeat\_writer]"}

For what I have tested, setting monitoring.enabled: true to false would work, but what I need have to be true.

Please help! Thanks.

---

<div class="post-metadata">

**Author:** ![mmk1995](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Post date:** [July 8, 2020, 8:37am UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/2 "2020-07-08T08:37:30Z")

</div>

Setting index privilege from "metricbeat-_" to "_" would also work, but this probably not a proper solution

---

<div class="post-metadata">

**Author:** ![James\_Cribbs](https://avatars.discourse-cdn.com/v4/letter/j/a88e57/32.png) [@James\_Cribbs](https://discuss.elastic.co/u/James_Cribbs)\
**Post date:** [July 8, 2020, 3:51pm UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/3 "2020-07-08T15:51:26Z")

</div>

I have the same problem when attempting to write to a filebeat index with logstash. We are running 7.8 across the board here. Our index privileges are `view_index_metadata`, `create_index`, `create_doc`, `index`. I tried adding the cluster privilages `cluster:admin/ingest/pipeline/get` as well but that doesn't change the outcome.

I have been looking at [this article](https://www.elastic.co/guide/en/beats/filebeat/current/feature-roles.html#privileges-to-publish-events) yesterday to troubleshoot this.

It does appear to be a permissions issue because when you give it basically all permissions to an index it doesn't error out. However that seems a bit risky.

---

<div class="post-metadata">

**Author:** ![mmk1995](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Post date:** [July 9, 2020, 1:28am UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/4 "2020-07-09T01:28:21Z")

</div>

I tried to set the index permissions to "all" but the security\_exception still exist.

---

<div class="post-metadata">

**Author:** ![James\_Cribbs](https://avatars.discourse-cdn.com/v4/letter/j/a88e57/32.png) [@James\_Cribbs](https://discuss.elastic.co/u/James_Cribbs)\
**Post date:** [July 9, 2020, 3:39pm UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/5 "2020-07-09T15:39:33Z")

</div>

@mmk1995,  
I have a support case opened and we are working to diagnose the issue. As of right now when I disable the service and reboot the server and start it again its able to send logs for a while before getting bogged down with errors. Can you try this to see if you see the same behavior?

---

<div class="post-metadata">

**Author:** ![mmk1995](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Post date:** [July 9, 2020, 4:31pm UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/6 "2020-07-09T16:31:00Z")

</div>

@James_Cribbs  
The only cases I am able to send log for me are as mentioned:

1. Setting index privilege from "metricbeat-_" to "_" would work
2. setting monitoring.enabled: true to false would work, but what I need have to be true.

For your suggestion, which server have to be rebooted? However, I doubt that reboot is not the solution since it is clearly the security issue, which I think it is the application level bug.

---

<div class="post-metadata">

**Author:** ![mmk1995](https://avatars.discourse-cdn.com/v4/letter/m/8797f3/32.png) [@mmk1995](https://discuss.elastic.co/u/mmk1995)\
**Post date:** [July 13, 2020, 4:05am UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/7 "2020-07-13T04:05:14Z")

</div>

Any help from Elastic Team pls?

---

<div class="post-metadata">

**Author:** ![James\_Cribbs](https://avatars.discourse-cdn.com/v4/letter/j/a88e57/32.png) [@James\_Cribbs](https://discuss.elastic.co/u/James_Cribbs)\
**Post date:** [July 22, 2020, 6:19pm UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/8 "2020-07-22T18:19:27Z")

</div>

@mmk1995 My problem was logstash was reading a variable to specify the index it wrote too, and when an event came with inconsistent data in that field it tried to create a new index. This was identified with assigning the account SuperUser privileges and identifying a suspiciously new index appear.

---

<div class="post-metadata">

**Author:** ![James\_Cribbs](https://avatars.discourse-cdn.com/v4/letter/j/a88e57/32.png) [@James\_Cribbs](https://discuss.elastic.co/u/James_Cribbs)\
**Post date:** [July 22, 2020, 6:24pm UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/9 "2020-07-22T18:24:34Z")

</div>

One other thing, when using logstash if you have multiple pipeline configs ensure that your input filters and outputs are using if statements control what events flow through them. When logstash starts up it complies a single configuration from each .conf file in the conf.d directory.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 19, 2020, 8:24pm UTC](https://discuss.elastic.co/t/status-403-type-security-exception-reason-action-indices-data-write-bulk-s/240299/10 "2020-08-19T20:24:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.