# ELK 6.3.2 no permissions for \[indices:admin/create\]

**URL:** <https://forum.search-guard.com/t/elk-6-3-2-no-permissions-for-indices-admin-create/1519>\
**Category:** Search Guard\
**Created:** [June 3, 2019, 2:11pm UTC](https://forum.search-guard.com/t/elk-6-3-2-no-permissions-for-indices-admin-create/1519 "2019-06-03T14:11:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![GhioRodolphe](https://avatars.discourse-cdn.com/v4/letter/g/d26b3c/32.png) [@GhioRodolphe](https://forum.search-guard.com/u/GhioRodolphe)\
**Post date:** [June 3, 2019, 2:11pm UTC](https://forum.search-guard.com/t/elk-6-3-2-no-permissions-for-indices-admin-create/1519/1 "2019-06-03T14:11:45Z")

</div>

Hello everyone,  
So i’m trying to add multiple output with different names into logstash

> ```auto
> output {
> if [type] == "JSON"{
> elasticsearch {
> hosts => ["localhost:9200"]
> index => "JSON-%{+YYYY.MM.dd}"
> document_type => "JSON"
> #+++ sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
> user => "logstash"
> #--- sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
> #+++ sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
> password => "logstash"
> #--- sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
> }
> }
> if [type] == "SYS"{
> elasticsearch {
> hosts => ["localhost:9200"]
> index => "SYS-%{+YYYY.MM.dd}"
> document_type => "SYS"
> #+++ sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
> user => "logstash"
> #--- sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
> #+++ sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
> password => "logstash"
> #--- sa Added by scr-sop-af-config-elksandbox. Do not remove this line.
> }
> }
> 
> }
> 
> ```

But I’ve this error when I restart all services:

> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,737][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,737][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,744][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,744][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,744][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,744][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,745][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,745][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,745][INFO][logstash.outputs.elasticsearch] retrying failed action with response code: 403 ({“type”=\>“security\_exception”, “reason”=\>“no permissions for [indices:admin/create] and User [name=logstash, roles=[logstash], requestedTenant=null]”})  
> Jun 03 07:09:39 qvisbcld0047 logstash[7167]: [2019-06-03T07:09:39,745][INFO][logstash.outputs.elasticsearch] Retrying individual bulk actions that failed or were rejected by the previous bulk request. {:count=\>30}

I’ve added this into the “sg\_roles.yml” but it didn’t work :  
indices:

> ‘_':  
> '_’:  
> - ALL

How can I fix this please ?

[sg\_config.yml (9.6 KB)](https://forum.search-guard.com/uploads/short-url/4gj1i3HaKHW96zuVwhLkr7XjF8P.yml)  
[sg\_roles.yml (6.2 KB)](https://forum.search-guard.com/uploads/short-url/qn9QAHKvEOFB9GEez1s4Rf0yRzP.yml) [elasticsearch.yml.example (9.3 KB)](https://forum.search-guard.com/uploads/short-url/rzHCLD6NXO2KxhBHEr7hSZMd58i.example)

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [June 4, 2019, 8:38am UTC](https://forum.search-guard.com/t/elk-6-3-2-no-permissions-for-indices-admin-create/1519/2 "2019-06-04T08:38:33Z")

</div>

The actual sg\_logstash role should give the logstash user the permission to create any index, so it looks good.

Have you uploaded the changed config via sgadmin to your cluster?

If so, can you please activate debug logging:

> **[Search Guard logging](https://docs.search-guard.com/latest/troubleshooting-setting-log-level)**
>
> Hot to set the Search Guard log level in a running Elasticsearch cluster for debugging.

Then start logstash again, and after the error occurs, post the content of the elasticsearch log here?

Thanks!

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [June 4, 2019, 8:38am UTC](https://forum.search-guard.com/t/elk-6-3-2-no-permissions-for-indices-admin-create/1519/3 "2019-06-04T08:38:38Z")

</div>



---

<div class="post-metadata">

**Author:** ![GhioRodolphe](https://avatars.discourse-cdn.com/v4/letter/g/d26b3c/32.png) [@GhioRodolphe](https://forum.search-guard.com/u/GhioRodolphe)\
**Post date:** [June 4, 2019, 9:01am UTC](https://forum.search-guard.com/t/elk-6-3-2-no-permissions-for-indices-admin-create/1519/4 "2019-06-04T09:01:29Z")

</div>

> [@jkressin](#):
>
> uploaded the changed config via sgadmin to your cluster

How can I upload the changed config via sgadmin to my cluster?

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [June 5, 2019, 7:40am UTC](https://forum.search-guard.com/t/elk-6-3-2-no-permissions-for-indices-admin-create/1519/5 "2019-06-05T07:40:07Z")

</div>

You use the sgadmin command line tool for this. If you have used the demo installation script to install Search Guard, you find a preconfigured sgadmin call in the search-guard-6/tools directory called `sgadmin_demo.sh`.

Otherwise, you can find the documentation here:

> **[Migrating configuration files](https://docs.search-guard.com/latest/sgadmin)**
>
> You can use sgadmin to migrate Search Guard 6 configuration files to the Search Guard 7 format automatically.

And some examples here:

> **[Examples](https://docs.search-guard.com/latest/sgadmin-examples)**
>
> Example sgadmin calls to manage the Search Guard configuration and Elasticsearch settings

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [June 26, 2019, 7:40am UTC](https://forum.search-guard.com/t/elk-6-3-2-no-permissions-for-indices-admin-create/1519/6 "2019-06-26T07:40:09Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.