# unable to create new indices after installing searchguard **URL:** \ **Category:** Search Guard\ **Created:** [November 20, 2018, 9:41am UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199 "2018-11-20T09:41:46Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Manjushree\_Gokhale](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@Manjushree\_Gokhale](https://forum.search-guard.com/u/Manjushree_Gokhale)\ **Post date:** [November 20, 2018, 9:41am UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/1 "2018-11-20T09:41:46Z")
When asking questions, please provide the following information: - Search Guard and Elasticsearch version 6.3.2-23.2 hi after installing searchguard. i am not able to creted new indices in elasticsearch using logstash. even when i list indices it only shows the indices which were created before installing searchguard plugin on elasticsearch it gives this error bash-4.4# curl -XGET “[http://elasticsearch:9200/\_cat/indices?pretty](http://elasticsearch:9200/_cat/indices?pretty)” -u logstash -p Enter host password for user ‘logstash’: { “error” : { “root\_cause” : [ { “type” : “ **security\_exception** ”, “reason” : “**no permissions for [indices:monitor/stats] and User [name=logstash**, roles=[logstash], requestedTenant=null]” } ], “type” : “ **security\_exception** ”, “reason” : “**no permissions for [indices:monitor/stats] and User [name=logstash**, roles=[logstash], requestedTenant=null]” }, “status” : **403** } my logstash.conf file looks like- output { if [namespace] != “kube-system” { elasticsearch { hosts =\> [“[http://elasticsearch:9200/](http://elasticsearch:9200/)”] index =\> “logstash-%{+YYYY.MM.dd}” **user =\> logstash** **password =\> logstash** } } } ---
**Author:** ![Mateusz\_Predki](https://avatars.discourse-cdn.com/v4/letter/m/76d3ee/32.png) [@Mateusz\_Predki](https://forum.search-guard.com/u/Mateusz_Predki)\ **Post date:** [November 20, 2018, 10:05am UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/2 "2018-11-20T10:05:19Z")
Check if this user Has create index privilage i have the same isue. Ruby codec on logstash will show you an error > **···** > > wt., 20.11.2018, 10:41: Manjushree Gokhale [gokhalemanjushree@gmail.com](mailto:gokhalemanjushree@gmail.com) napisał(a): > > > When asking questions, please provide the following information: > > > - Search Guard and Elasticsearch version 6.3.2-23.2 > > > > > > hi > > > after installing searchguard. i am not able to creted new indices in elasticsearch using logstash. > > > even when i list indices it only shows the indices which were created before installing searchguard plugin on elasticsearch > > > > > > > > > it gives this error > > > bash-4.4# curl -XGET “[http://elasticsearch:9200/\_cat/indices?pretty](http://elasticsearch:9200/_cat/indices?pretty)” -u logstash -p > > > Enter host password for user ‘logstash’: > > > { > > > “error” : { > > > “root\_cause” : [ > > > { > > > “type” : “ **security\_exception** ”, > > > “reason” : “**no permissions for [indices:monitor/stats] and User [name=logstash**, roles=[logstash], requestedTenant=null]” > > > } > > > ], > > > “type” : “ **security\_exception** ”, > > > “reason” : “**no permissions for [indices:monitor/stats] and User [name=logstash**, roles=[logstash], requestedTenant=null]” > > > }, > > > “status” : **403** > > > } > > > > > > > > > my logstash.conf file looks like- > > > > > > output { > > > > > > if [namespace] != “kube-system” { > > > elasticsearch { > > > hosts =\> [“[http://elasticsearch:9200/](http://elasticsearch:9200/)”] > > > index =\> “logstash-%{+YYYY.MM.dd}” > > > **user =\> logstash** > > > **password =\> logstash** > > > } > > > } > > > > > > } > > > > > > > > > > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/ee5609e5-3d12-4a94-8c7f-f4c39892fd95%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/ee5609e5-3d12-4a94-8c7f-f4c39892fd95%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Manjushree\_Gokhale](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@Manjushree\_Gokhale](https://forum.search-guard.com/u/Manjushree_Gokhale)\ **Post date:** [November 20, 2018, 10:11am UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/3 "2018-11-20T10:11:06Z")
I have given all the access to create indices in sg\_roles.yml # For logstash and beats sg\_logstash: cluster: - CLUSTER\_MONITOR - CLUSTER\_COMPOSITE\_OPS - indices:admin/template/get - indices:admin/template/put - indices:data/write/bulk\* - indices:monitor/stats\* indices: ‘logstash-\*’: ‘\*’: - CRUD - CREATE\_INDEX - INDICES\_MONITOR ‘_beat_’: ‘\*’: - CRUD - CREATE\_INDEX - INDICES\_MONITOR still i am getting the same error ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [November 20, 2018, 4:24pm UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/4 "2018-11-20T16:24:00Z")
When debugging permission problems, please always post the ES log file and your roles definition as well. The curl output alone will not tell you which exact index/permission etc. is missing, Thanks. > **···** > > On Tuesday, November 20, 2018 at 10:41:46 AM UTC+1, Manjushree Gokhale wrote: > > > When asking questions, please provide the following information: > > > - Search Guard and Elasticsearch version 6.3.2-23.2 > > > > > > hi > > > after installing searchguard. i am not able to creted new indices in elasticsearch using logstash. > > > even when i list indices it only shows the indices which were created before installing searchguard plugin on elasticsearch > > > > > > > > > it gives this error > > > bash-4.4# curl -XGET “[http://elasticsearch:9200/\_cat/indices?pretty](http://elasticsearch:9200/_cat/indices?pretty)” -u logstash -p > > > Enter host password for user ‘logstash’: > > > { > > > “error” : { > > > “root\_cause” : [ > > > { > > > “type” : “ **security\_exception** ”, > > > “reason” : “**no permissions for [indices:monitor/stats] and User [name=logstash**, roles=[logstash], requestedTenant=null]” > > > } > > > ], > > > “type” : “ **security\_exception** ”, > > > “reason” : “**no permissions for [indices:monitor/stats] and User [name=logstash**, roles=[logstash], requestedTenant=null]” > > > }, > > > “status” : **403** > > > } > > > > > > > > > my logstash.conf file looks like- > > > > > > output { > > > > > > if [namespace] != “kube-system” { > > > elasticsearch { > > > hosts =\> [“[http://elasticsearch:9200/](http://elasticsearch:9200/)”] > > > index =\> “logstash-%{+YYYY.MM.dd}” > > > **user =\> logstash** > > > **password =\> logstash** > > > } > > > } > > > > > > } > > > > > > > > > ---
**Author:** ![Manjushree\_Gokhale](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@Manjushree\_Gokhale](https://forum.search-guard.com/u/Manjushree_Gokhale)\ **Post date:** [November 26, 2018, 5:53am UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/5 "2018-11-26T05:53:16Z")
here you can see the logs of ES [2018-11-20T11:53:12,624][INFO][c.f.s.c.IndexBaseConfigurationRepository] Search Guard License Type: TRIAL, valid [2018-11-20T11:53:47,541][INFO][c.f.s.p.PrivilegesEvaluator] No index-level perm match for User [name=logstash, roles=[logstash], requestedTenant=null] Resolved [aliases=[_], indices=[_], allIndices=[_], types=[_], isAll()=true, isEmpty()=false] [Action [indices:monitor/stats]] [RolesChecked [sg\_own\_index, sg\_all\_user, sg\_logstash]] [2018-11-20T11:53:47,542][INFO][c.f.s.p.PrivilegesEvaluator] No permissions for [indices:monitor/stats] [2018-11-20T11:53:53,494][INFO][c.f.s.p.PrivilegesEvaluator] No index-level perm match for User [name=logstash, roles=[logstash], requestedTenant=null] Resolved [aliases=[_], indices=[_], allIndices=[_], types=[_], isAll()=true, isEmpty()=false] [Action [indices:monitor/stats]] [RolesChecked [sg\_own\_index, sg\_all\_user, sg\_logstash]] [2018-11-20T11:53:53,494][INFO][c.f.s.p.PrivilegesEvaluator] No permissions for [indices:monitor/stats] and below mentioned is the role i have created for logstash. # For logstash and beats sg\_logstash: cluster: - CLUSTER\_MONITOR - CLUSTER\_COMPOSITE\_OPS - indices:admin/template/get - indices:admin/template/put - indices:data/write/bulk\* - indices:monitor/stats\* indices: ‘logstash-\*’: ‘\*’: - CRUD - CREATE\_INDEX - INDICES\_MONITOR ‘_beat_’: ‘\*’: - CRUD - CREATE\_INDEX - INDICES\_MONITOR > **···** > > > > ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [November 26, 2018, 10:40am UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/6 "2018-11-26T10:40:16Z")
From the error message you can see that Kibana is actually using a wildcard, means all indices are queried: 2018-11-20T11:53:47,541][INFO][c.f.s.p.PrivilegesEvaluator] No index-level perm match for User [name=logstash, roles=[logstash], requestedTenant=null] **Resolved [aliases=[_], indices=[_], allIndices=[_], types=[_], isAll()=true, isEmpty()=false**] [Action [indices:monitor/stats]] [RolesChecked [sg\_own\_index, sg\_all\_user, sg\_logstash]] If you do not have it already, please try to enable the do\_not\_fail\_on\_forbidden feature in sg\_config.yml and try again: searchguard: dynamic: kibana: do\_not\_fail\_on\_forbidden: true `` You can read more about this feature here: [https://docs.search-guard.com/latest/kibana-plugin-installation#configuring-elasticsearch-enable-do-not-fail-on-forbidden](https://docs.search-guard.com/latest/kibana-plugin-installation#configuring-elasticsearch-enable-do-not-fail-on-forbidden) > **···** > > On Monday, November 26, 2018 at 6:53:16 AM UTC+1, Manjushree Gokhale wrote: > > > > > > > > > > > > > > > > > > here you can see the logs of ES > > > > > > [2018-11-20T11:53:12,624][INFO][c.f.s.c.IndexBaseConfigurationRepository] Search Guard License Type: TRIAL, valid > > > [2018-11-20T11:53:47,541][INFO][c.f.s.p.PrivilegesEvaluator] No index-level perm match for User [name=logstash, roles=[logstash], requestedTenant=null] Resolved [aliases=[_], indices=[_], allIndices=[_], types=[_], isAll()=true, isEmpty()=false] [Action [indices:monitor/stats]] [RolesChecked [sg\_own\_index, sg\_all\_user, sg\_logstash]] > > > [2018-11-20T11:53:47,542][INFO][c.f.s.p.PrivilegesEvaluator] No permissions for [indices:monitor/stats] > > > [2018-11-20T11:53:53,494][INFO][c.f.s.p.PrivilegesEvaluator] No index-level perm match for User [name=logstash, roles=[logstash], requestedTenant=null] Resolved [aliases=[_], indices=[_], allIndices=[_], types=[_], isAll()=true, isEmpty()=false] [Action [indices:monitor/stats]] [RolesChecked [sg\_own\_index, sg\_all\_user, sg\_logstash]] > > > [2018-11-20T11:53:53,494][INFO][c.f.s.p.PrivilegesEvaluator] No permissions for [indices:monitor/stats] > > > > > > > > > and below mentioned is the role i have created for logstash. > > > # For logstash and beats > > > sg\_logstash: > > > cluster: > > > - CLUSTER\_MONITOR > > > - CLUSTER\_COMPOSITE\_OPS > > > - indices:admin/template/get > > > - indices:admin/template/put > > > - indices:data/write/bulk\* > > > - indices:monitor/stats\* > > > > > > indices: > > > ‘logstash-\*’: > > > ‘\*’: > > > - CRUD > > > - CREATE\_INDEX > > > - INDICES\_MONITOR > > > ‘_beat_’: > > > ‘\*’: > > > - CRUD > > > - CREATE\_INDEX > > > - INDICES\_MONITOR > > > > > ---
**Author:** ![Manjushree\_Gokhale](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@Manjushree\_Gokhale](https://forum.search-guard.com/u/Manjushree_Gokhale)\ **Post date:** [November 26, 2018, 12:13pm UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/7 "2018-11-26T12:13:06Z")
Hi, I have already made it true. the problem is related to logstash in my sg\_logstash role logstash is able to access all the indices but it is not creating any indices from the day i have installed searchguard plugin. > **···** > > > > > > ---
**Author:** ![Manjushree\_Gokhale](https://avatars.discourse-cdn.com/v4/letter/m/f07891/32.png) [@Manjushree\_Gokhale](https://forum.search-guard.com/u/Manjushree_Gokhale)\ **Post date:** [November 27, 2018, 6:45am UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/8 "2018-11-27T06:45:00Z")
Hi, The problem i was facing is now solved. thank you. ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [November 28, 2018, 10:53am UTC](https://forum.search-guard.com/t/unable-to-create-new-indices-after-installing-searchguard/1199/9 "2018-11-28T10:53:37Z")
So, what was the problem and how did you solve it? Would be helpful to other users. > **···** > > On Tuesday, November 27, 2018 at 7:45:01 AM UTC+1, Manjushree Gokhale wrote: > > > Hi, > > > The problem i was facing is now solved. > > > thank you.