[indices:admin/create] is unauthorized for user Elastic Stack

frahmn
Sun, 30 Nov 2025 05:04:12 +0000
Beats

I have read through many articles and am not able to solve this issue for me. I’m trying to generate a new api key that has rights over creating indicies using filebeat. I have tried doing this through the superuser account but per the below post, it is not an option anymore so I created a new account with no roles and just an api key with the proper permissions but still getting the error

this action is granted by the index privileges [auto_configure,create_index,manage,all]"}, dropping event!"

Below is the configuration I used to grant permissions for a a different user beside the default elastic user

POST /_security/api_key
{
"name": "test-key",
"role_descriptors": {
"filebeat_writer": {
"cluster": ["monitor", "read_ilm", "read_pipeline"],
"index": [
        {
"names": ["*-*"],
"privileges": ["auto_configure","create_index","manage","all"]
        }
      ]
    }
  }
}

Any help is appreciated as I have been trying to solve this for a few weeks now.

Security_exception: action [indices:admin/create] is unauthorized for user [elasticsearch] with effective roles [superuser] on restricted indices [.kibana_analytics_8.13.4_001], this action is granted by the index privileges [create_index,manage,all]' Kibana

Hi there, I have been looking at similar topics, but I haven't been able to resolve this error. First of all, I wanted to mention that I faced some problems when I installed Elasticsearch, because the default user "elastic" was not created, so I had to create a new user called "elasticsearch". Now, when I try to start Kibana, I'm getting this error: [2024-07-26T10:20:26.714-03:00][ERROR][savedobjects-service] [.kibana] Action failed with 'security_exception Root causes: …

18 posts - 2 participants