Skip to content

[Island Browser] Cannot execute ILM policy delete step #235999

@janvi-elastic

Description

@janvi-elastic

Kibana/Elasticsearch Stack version: 8.18.5

Describe the bug:

The kibana_system role lacks the necessary permissions to delete system indices related to logs-island_browser.user and logs-island_browser.device, as defined in the ILM policy located here.

Steps to reproduce:

  1. Checkout the janvi-elastic:package-island_browser_user_datastream and janvi-elastic:package-island_browser_device_datastream branch for Island Browser package and create a zip of the respective package.
  2. Upload the package zip to a hosted deployment.
  3. Add the integration.
  4. Monitor the hidden index under Stack Management > Index Management and wait for the ILM policy’s delete phase to trigger.

Current behavior:

  • It shows permission issue in deleting the index
{
  "failed_step": "delete",
  "step_info": {
    "type": "security_exception",
    "reason": "action [indices:admin/delete] is unauthorized for user [found-internal-kibana4-server] with effective roles [found-internal-kibana4-server,kibana_system] on indices [.ds-logs-island_browser.user-default-2025.09.02-000001], this action is granted by the index privileges [delete_index,manage,all]"
  }
}
{
  "failed_step": "delete",
  "step_info": {
    "type": "security_exception",
    "reason": "action [indices:admin/delete] is unauthorized for user [found-internal-kibana4-server] with effective roles [found-internal-kibana4-server,kibana_system] on indices [.ds-logs-island_browser.device-default-2025.09.02-000001], this action is granted by the index privileges [delete_index,manage,all]"
  }
}

Expected behavior:

  • Index must be delete after the time duration mentioned in the ILM policy

Metadata

Metadata

Assignees

No one assigned

    Labels

    Team:FleetTeam label for Observability Data Collection Fleet team

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions