# code:403 when sending documents logstash to elasticsearch

**URL:** <https://forum.search-guard.com/t/code-403-when-sending-documents-logstash-to-elasticsearch/776>\
**Category:** Search Guard\
**Created:** [February 2, 2018, 5:14pm UTC](https://forum.search-guard.com/t/code-403-when-sending-documents-logstash-to-elasticsearch/776 "2018-02-02T17:14:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Francis\_Matera](https://avatars.discourse-cdn.com/v4/letter/f/b77776/32.png) [@Francis\_Matera](https://forum.search-guard.com/u/Francis_Matera)\
**Post date:** [February 2, 2018, 5:14pm UTC](https://forum.search-guard.com/t/code-403-when-sending-documents-logstash-to-elasticsearch/776/1 "2018-02-02T17:14:55Z")

</div>

I am receiving the following error when try to ingest documents Logstash to Elasticsearch:

[2018-02-02T11:54:35,329][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:data/write/index, indices:data/write/bulk[s]] and User [name=logstash, roles=[logstash], requestedTenant=null]”})

Logstash output:

output {

elasticsearch {

user =\> logstash

password =\> logstash

ssl =\> true

ssl\_certificate\_verification =\> true

cacert =\> “/etc/elasticsearch/root-ca.pem”

hosts =\> [“[https://localhost:9200](https://localhost:9200)”]

index =\> “cdrs4”

}

}

I used the demo installer. Would I need to change sg\_roles.yml? I have not changed anything in this file. I am assuming I would have to add permission for indices:data/write/index, indices:data/write/bulk just not sure of the syntax and how to add it.

Thank you, Frank

---

<div class="post-metadata">

**Author:** ![Francis\_Matera](https://avatars.discourse-cdn.com/v4/letter/f/b77776/32.png) [@Francis\_Matera](https://forum.search-guard.com/u/Francis_Matera)\
**Post date:** [February 2, 2018, 5:16pm UTC](https://forum.search-guard.com/t/code-403-when-sending-documents-logstash-to-elasticsearch/776/2 "2018-02-02T17:16:08Z")

</div>

I am on version 6.0.1 of Logstash and Elasticsearch.

> **···**
>
> On Friday, February 2, 2018 at 12:14:55 PM UTC-5, Francis Matera wrote:
> 
> > I am receiving the following error when try to ingest documents Logstash to Elasticsearch:
> 
> > [2018-02-02T11:54:35,329][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:data/write/index, indices:data/write/bulk[s]] and User [name=logstash, roles=[logstash], requestedTenant=null]”})
> 
> > 
> 
> > Logstash output:
> 
> > 
> 
> > output {
> 
> > elasticsearch {
> 
> > user =\> logstash
> 
> > password =\> logstash
> 
> > ssl =\> true
> 
> > ssl\_certificate\_verification =\> true
> 
> > cacert =\> “/etc/elasticsearch/root-ca.pem”
> 
> > hosts =\> [“[https://localhost:9200](https://localhost:9200)”]
> 
> > index =\> “cdrs4”
> 
> > }
> 
> > }
> 
> > 
> 
> > 
> 
> > I used the demo installer. Would I need to change sg\_roles.yml? I have not changed anything in this file. I am assuming I would have to add permission for indices:data/write/index, indices:data/write/bulk just not sure of the syntax and how to add it.
> 
> > 
> 
> > Thank you, Frank
> 
> > 
> 
> >

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [February 3, 2018, 5:26pm UTC](https://forum.search-guard.com/t/code-403-when-sending-documents-logstash-to-elasticsearch/776/3 "2018-02-03T17:26:28Z")

</div>

There are several ways how to achieve that. The easiest is to add the required permissions for your index “cdrs4” to the logstash user. If you use the config GUI, create a a new index “cdrs4” for the logstash role, and add the action groups CRUD and, if the index does not exists yet. the CREATE\_INDEX.

If you use sgadmin, add the permissions to the logstash role in sg\_roles.yml:

# For logstash and beats

sg\_logstash:

readonly: true

cluster:

- CLUSTER\_MONITOR

- CLUSTER\_COMPOSITE\_OPS

- indices:admin/template/get

- indices:admin/template/put

indices:

‘logstash-\*’:

‘\*’:

- CRUD

- CREATE\_INDEX

‘_beat_’:

‘\*’:

- CRUD

- CREATE\_INDEX

‘cdrs4’:

‘\*’:

- CRUD

- CREATE\_INDEX

``

After that, upload the changed config with sgadmin.

> **···**
>
> On Friday, February 2, 2018 at 6:16:08 PM UTC+1, Francis Matera wrote:
> 
> > I am on version 6.0.1 of Logstash and Elasticsearch.
> > 
> > On Friday, February 2, 2018 at 12:14:55 PM UTC-5, Francis Matera wrote:
> > 
> > > I am receiving the following error when try to ingest documents Logstash to Elasticsearch:
> 
> > > [2018-02-02T11:54:35,329][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:data/write/index, indices:data/write/bulk[s]] and User [name=logstash, roles=[logstash], requestedTenant=null]”})
> 
> > >
> 
> > > Logstash output:
> 
> > >
> 
> > > output {
> 
> > > elasticsearch {
> 
> > > user =\> logstash
> 
> > > password =\> logstash
> 
> > > ssl =\> true
> 
> > > ssl\_certificate\_verification =\> true
> 
> > > cacert =\> “/etc/elasticsearch/root-ca.pem”
> 
> > > hosts =\> [“[https://localhost:9200](https://localhost:9200)”]
> 
> > > index =\> “cdrs4”
> 
> > > }
> 
> > > }
> 
> > >
> 
> > >
> 
> > > I used the demo installer. Would I need to change sg\_roles.yml? I have not changed anything in this file. I am assuming I would have to add permission for indices:data/write/index, indices:data/write/bulk just not sure of the syntax and how to add it.
> 
> > >
> 
> > > Thank you, Frank
> 
> > >
> 
> > >