登录Elasticsearch遇403权限错误：用户suchit角色权限不足

问题场景 #

执行以下命令创建用户并分配角色：

elasticsearch-users useradd suchit -p suchit -r network,monitoring

启动Elasticsearch后出现403权限错误，错误详情：

{
"error": {
"root_cause": [
{
"type": "security_exception",
"reason": "action [cluster:monitor/main] is unauthorized for user [suchit] with roles [monitoring,network], this action is granted by the cluster privileges [monitor,manage,all]"
}
],
"type": "security_exception",
"reason": "action [cluster:monitor/main] is unauthorized for user [suchit] with roles [monitoring,network], this action is granted by the cluster privileges [monitor,manage,all]"
},
"status": 403
}

错误原因 #

monitoring和network角色不包含cluster:monitor/main集群权限，而Elasticsearch启动或登录时需要执行该监控操作，因此触发权限拒绝。

解决步骤 #

• 给用户添加具备cluster:monitor/main权限的角色，Elasticsearch内置的monitor角色包含该权限，执行以下命令修改用户角色：

elasticsearch-users usermod suchit -r network,monitoring,monitor

• 重启Elasticsearch服务，重新登录即可正常访问。

内容的提问来源于stack exchange，提问作者Suchit Khadtar