# Watcher showing security\_exception error

**URL:** <https://discuss.elastic.co/t/watcher-showing-security-exception-error/361393>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-alerting\
**Created:** [June 13, 2024, 11:16am UTC](https://discuss.elastic.co/t/watcher-showing-security-exception-error/361393 "2024-06-13T11:16:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sayali](https://avatars.discourse-cdn.com/v4/letter/s/a9adbd/32.png) [@Sayali](https://discuss.elastic.co/u/Sayali)\
**Post date:** [June 13, 2024, 11:16am UTC](https://discuss.elastic.co/t/watcher-showing-security-exception-error/361393/1 "2024-06-13T11:16:23Z")

</div>

Hello,  
I have been facing an issue with some watchers regarding role privileges due to which the watchers don't trigger and show error. But I have superuser privileges.

```auto
"result": {
    "execution_time": "2024-06-13T07:39:04.586Z",
    "execution_duration": 4,
    "input": {
      "type": "search",
      "status": "failure",
      "error": {
        "root_cause": [
          {
            "type": "security_exception",
            "reason": "action [indices:data/read/search] is unauthorized for user [ssogd@company_name.com] with effective roles [superuser], this action is granted by the index privileges [read,all]"
          }
        ],
        "type": "security_exception",
        "reason": "action [indices:data/read/search] is unauthorized for user [ssogd@company_name.com] with effective roles [superuser], this action is granted by the index privileges [read,all]",
        "caused_by": {
          "type": "illegal_argument_exception",
          "reason": "node [special-2] does not have the remote cluster client role enabled"
        }
      },

```

Also, please note that special-2 is a local elasticsearch node and not a remote node.  
Kindly help me with this. Thanks.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 14, 2024, 1:01am UTC](https://discuss.elastic.co/t/watcher-showing-security-exception-error/361393/2 "2024-06-14T01:01:44Z")

</div>

Are you trying to search on a remote cluster?

---

<div class="post-metadata">

**Author:** ![Sayali](https://avatars.discourse-cdn.com/v4/letter/s/a9adbd/32.png) [@Sayali](https://discuss.elastic.co/u/Sayali)\
**Post date:** [June 19, 2024, 6:11am UTC](https://discuss.elastic.co/t/watcher-showing-security-exception-error/361393/3 "2024-06-19T06:11:16Z")

</div>

Hi Tim,

Yes I am searching on various remote clusters.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 19, 2024, 6:16am UTC](https://discuss.elastic.co/t/watcher-showing-security-exception-error/361393/4 "2024-06-19T06:16:57Z")

</div>

> node [special-2] does not have the remote cluster client role enabled

The node you are using (`special-2`) does not have the `remote_cluster_client` role. That means it is not allowed to make connections to other clusters, therefore you cannot perform CCS queries from this node.

Please read the documentation for `remote_cluster_client` here:

- [Remote cluster settings | Elasticsearch Guide [8.14] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/remote-clusters-settings.html)

---

<div class="post-metadata">

**Author:** ![Sayali](https://avatars.discourse-cdn.com/v4/letter/s/a9adbd/32.png) [@Sayali](https://discuss.elastic.co/u/Sayali)\
**Post date:** [June 19, 2024, 6:47am UTC](https://discuss.elastic.co/t/watcher-showing-security-exception-error/361393/5 "2024-06-19T06:47:28Z")

</div>

Thanks for the prompt response, Tim.

We have recently upgraded all the clusters from 7.17 to 8.13 and the watcher was not giving any error before upgrade. May I please know what changed post upgrade. Please note that pre and post upgrade, we did not make any changes in elasticsearch.yml.

Also, if I create the same watcher again, will it execute on some other node, instead of special-2?