# Elasticsearch role for Graylog

**URL:** <https://community.graylog.org/t/elasticsearch-role-for-graylog/18660>\
**Category:** Graylog Central (peer support)\
**Created:** [February 2, 2021, 5:17pm UTC](https://community.graylog.org/t/elasticsearch-role-for-graylog/18660 "2021-02-02T17:17:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gorek](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gorek/32/7681_2.png) [@gorek](https://community.graylog.org/u/gorek)\
**Post date:** [February 2, 2021, 5:17pm UTC](https://community.graylog.org/t/elasticsearch-role-for-graylog/18660/1 "2021-02-02T17:17:54Z")

</div>

I’m using native authentication for my Elasticsearch cluster.  
I would like to create a user with the least privileges necessary for Graylog to function.  
In another post I found:

> Graylog needs to be able to create indices and do all housekeeping on them

So I created Elasticsearch role for graylog user as below:

> POST \_security/role/graylog\_user  
> {  
> “indices” : [  
> {  
> “names”: [“graylog\_\*”,“gl-\*”],  
> “privileges” : [“all”]  
> }  
> ]  
> }

and assign role to user.  
After starting Graylog I can see in logs:

> ERROR [Cluster] Couldn’t read cluster health for indices [graylog\_\*, gl-events\_\*, gl-system-events\_\*]

When I assign superuser role to graylog user everything works perfect.  
Have graylog user need any other privileges? Which exactly?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 4, 2021, 8:01pm UTC](https://community.graylog.org/t/elasticsearch-role-for-graylog/18660/2 "2021-02-04T20:01:38Z")

</div>

> <https://github.com/Graylog2/graylog2-server/issues/6212>
>
> Recently I've observed what I consider to be unexpected behaviour while bootstraping graylog as an unprivileged user.
> Here is a link to...

---

<div class="post-metadata">

**Author:** ![gorek](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gorek/32/7681_2.png) [@gorek](https://community.graylog.org/u/gorek)\
**Post date:** [February 9, 2021, 9:22pm UTC](https://community.graylog.org/t/elasticsearch-role-for-graylog/18660/3 "2021-02-09T21:22:33Z")

</div>

Good example is better than 1000 words 😀  
My user had lacked permission for cluster.  
After adding cluster privileges “monitor” and “manage\_index\_templates” everything works 🙂

Thank you for help Jan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 23, 2021, 9:23pm UTC](https://community.graylog.org/t/elasticsearch-role-for-graylog/18660/4 "2021-02-23T21:23:31Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.