# What are the minimum permissions for an application-defined user to ingest data into Elasticsearch? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 11, 2020, 1:13am UTC](https://discuss.elastic.co/t/what-are-the-minimum-permissions-for-an-application-defined-user-to-ingest-data-into-elasticsearch/254994 "2020-11-11T01:13:02Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![deaugur](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@deaugur](https://discuss.elastic.co/u/deaugur)\ **Post date:** [November 11, 2020, 1:13am UTC](https://discuss.elastic.co/t/what-are-the-minimum-permissions-for-an-application-defined-user-to-ingest-data-into-elasticsearch/254994/1 "2020-11-11T01:13:02Z")
I'm new to Elastic and am currently enabling SSL/TLS across our cluster. I've currently configured applications that ingest to Elasticsearch to use the built-in superuser 'elastic' for authentication. This is less than ideal due to the additional permissions on the user that aren't required for simple ingestion. I would like to create application-specific users that have the minimum required permissions to simply ingest data into Elasticsearch (e.g. if using Logstash, I would like a `logstash_ingest` application-user that authenticates the pipelines for elasticsearch ingestion, or if using NiFi, I would like a `nifi_ingest` application-user). Thanks in advance! ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [November 11, 2020, 5:31am UTC](https://discuss.elastic.co/t/what-are-the-minimum-permissions-for-an-application-defined-user-to-ingest-data-into-elasticsearch/254994/2 "2020-11-11T05:31:20Z")
Hi, Welcome to this forum! 🥳 Elastic has a good bit of information on this topic for [LogStash](https://www.elastic.co/guide/en/logstash/current/ls-security.html) but it can be used for other writers too. This can be reduced depending on your usecase. Best regards Wolfram ---
**Author:** ![deaugur](https://avatars.discourse-cdn.com/v4/letter/d/aeb1de/32.png) [@deaugur](https://discuss.elastic.co/u/deaugur)\ **Post date:** [November 11, 2020, 9:46pm UTC](https://discuss.elastic.co/t/what-are-the-minimum-permissions-for-an-application-defined-user-to-ingest-data-into-elasticsearch/254994/3 "2020-11-11T21:46:47Z")
Hi Wolfram. I've previously used the linked documentation for Logstash pipeline ingestion into Elasticsearch, however, I was encountering authentication errors. Before implementing the permissions in the documentation, ingestion was authenticated via the `elastic` built-in superuser. When implementing the `logstash_internal` user, Logstash was no longer able to successfully ingest into my Elastisearch cluster. Immediately reverting it back to the `elastic` superuser fixed the authentication issues. Would there be any settings or permissions not listed in _Configuring Security in Logstash_ docs that would cause authentication errors? For more reference, these are HTTP 401 errors seemingly generated by each Elasticsearch node. ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [November 12, 2020, 5:05am UTC](https://discuss.elastic.co/t/what-are-the-minimum-permissions-for-an-application-defined-user-to-ingest-data-into-elasticsearch/254994/4 "2020-11-12T05:05:55Z")
I don't think that there is something missing as I have used this documentation successfully in the past. Can you post the error message? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 10, 2020, 5:05am UTC](https://discuss.elastic.co/t/what-are-the-minimum-permissions-for-an-application-defined-user-to-ingest-data-into-elasticsearch/254994/5 "2020-12-10T05:05:57Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.