-
Notifications
You must be signed in to change notification settings - Fork 8.5k
Closed as duplicate of#235512
Labels
Team:FleetTeam label for Observability Data Collection Fleet teamTeam label for Observability Data Collection Fleet team
Description
Kibana/Elasticsearch Stack version: 8.18.5
Describe the bug:
The kibana_system role lacks the necessary permissions to delete system indices related to logs-island_browser.user and logs-island_browser.device, as defined in the ILM policy located here.
Steps to reproduce:
- Checkout the
janvi-elastic:package-island_browser_user_datastreamandjanvi-elastic:package-island_browser_device_datastreambranch forIsland Browser packageand create a zip of the respective package. - Upload the package zip to a hosted deployment.
- Add the integration.
- Monitor the hidden index under
Stack Management > Index Managementand wait for the ILM policy’s delete phase to trigger.
Current behavior:
- It shows permission issue in deleting the index
{
"failed_step": "delete",
"step_info": {
"type": "security_exception",
"reason": "action [indices:admin/delete] is unauthorized for user [found-internal-kibana4-server] with effective roles [found-internal-kibana4-server,kibana_system] on indices [.ds-logs-island_browser.user-default-2025.09.02-000001], this action is granted by the index privileges [delete_index,manage,all]"
}
}
{
"failed_step": "delete",
"step_info": {
"type": "security_exception",
"reason": "action [indices:admin/delete] is unauthorized for user [found-internal-kibana4-server] with effective roles [found-internal-kibana4-server,kibana_system] on indices [.ds-logs-island_browser.device-default-2025.09.02-000001], this action is granted by the index privileges [delete_index,manage,all]"
}
}
Expected behavior:
- Index must be delete after the time duration mentioned in the ILM policy
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
Team:FleetTeam label for Observability Data Collection Fleet teamTeam label for Observability Data Collection Fleet team