[axonius] - Fix Cannot execute ILM policy delete step in other datastreams by muskan-agarwal26 · Pull Request #140046 · elastic/elasticsearch

muskan-agarwal26 · 2025-12-30T06:50:38Z

PR Description:

This PR focuses on the short term solution which add the logs-axonius.alert_and_incident-*,logs-axonius.storage-*,logs-axonius.ticket-*,logs-axonius.application-*,logs-axonius.network-*,logs-axonius.identity-*,logs-axonius.exposure-*,logs-axonius.compute-*,logs-axonius.gateway-*,logs-axonius.user-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PR. As it ships transform pipeline too hence read, write permissions are also required.

Current behavior:

It shows permission issue while deleting the index.

Related Issues:

[New Integration] Axonius integrations#15034

Note: All the data streams listed above are as discussed with the team.

github-actions · 2025-12-30T06:56:01Z

ℹ️ Important: Docs version tagging

👋 Thanks for updating the docs! Just a friendly reminder that our docs are now cumulative. This means all 9.x versions are documented on the same page and published off of the main branch, instead of creating separate pages for each minor version.

We use applies_to tags to mark version-specific features and changes.

Expand for a quick overview

When to use applies_to tags:

✅ At the page level to indicate which products/deployments the content applies to (mandatory)
✅ When features change state (e.g. preview, ga) in a specific version
✅ When availability differs across deployments and environments

What NOT to do:

❌ Don't remove or replace information that applies to an older version
❌ Don't add new information that applies to a specific version without an applies_to tag
❌ Don't forget that applies_to tags can be used at the page, section, and inline level

🤔 Need help?

Check out the cumulative docs guidelines
Reach out in the #docs Slack channel

elasticsearchmachine · 2025-12-30T07:08:52Z

Pinging @elastic/es-security (Team:Security)

ShourieG · 2025-12-30T07:10:40Z

buildkite test this please

ShourieG

LGTM

ShourieG

LGTM

…reams (elastic#140046) This PR focuses on the short term solution which add the logs-axonius.alert_and_incident-*,logs-axonius.storage-*,logs-axonius.ticket-*,logs-axonius.application-*,logs-axonius.network-*,logs-axonius.identity-*,logs-axonius.exposure-*,logs-axonius.compute-*,logs-axonius.gateway-*,logs-axonius.user-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PR. As it ships transform pipeline too hence read, write permissions are also required. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai> (cherry picked from commit cba13bc)

muskan-agarwal26 · 2025-12-30T10:15:00Z

💔 Some backports could not be created

Status	Branch	Result
✅	9.3
❌	9.2	Conflict resolution was aborted by the user
❌	9.1	Conflict resolution was aborted by the user
❌	8.19	Conflict resolution was aborted by the user

Manual backport

To create the backport manually run:

backport --pr 140046

Questions ?

Please refer to the Backport tool documentation

SiddharthMantri · 2025-12-30T10:49:05Z

@ShourieG @muskan-agarwal26 - Can we please wait for approval from @elastic/kibana-security for merging changes related to Kibana system user permissions?

…reams (elastic#140046) This PR focuses on the short term solution which add the logs-axonius.alert_and_incident-*,logs-axonius.storage-*,logs-axonius.ticket-*,logs-axonius.application-*,logs-axonius.network-*,logs-axonius.identity-*,logs-axonius.exposure-*,logs-axonius.compute-*,logs-axonius.gateway-*,logs-axonius.user-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PR. As it ships transform pipeline too hence read, write permissions are also required. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai> (cherry picked from commit cba13bc) # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

muskan-agarwal26 · 2025-12-30T11:57:02Z

💚 All backports created successfully

Status	Branch	Result
✅	9.2
✅	9.1
✅	8.19

Questions ?

Please refer to the Backport tool documentation

…reams (elastic#140046) This PR focuses on the short term solution which add the logs-axonius.alert_and_incident-*,logs-axonius.storage-*,logs-axonius.ticket-*,logs-axonius.application-*,logs-axonius.network-*,logs-axonius.identity-*,logs-axonius.exposure-*,logs-axonius.compute-*,logs-axonius.gateway-*,logs-axonius.user-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PR. As it ships transform pipeline too hence read, write permissions are also required. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai> (cherry picked from commit cba13bc) # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

ShourieG · 2025-12-31T10:02:33Z

@ShourieG @muskan-agarwal26 - Can we please wait for approval from @elastic/kibana-security for merging changes related to Kibana system user permissions?

@SiddharthMantri, sure. I only fast tracked it here since the original PR was already approved and this is an exact replica of that.

SiddharthMantri · 2025-12-31T13:41:28Z

@ShourieG Aah understood. Having a link to the PR in the description would have helped - i was a bit concerned with the added index privileges for the user. Thanks!

…reams (#140046) (#140050) This PR focuses on the short term solution which add the logs-axonius.alert_and_incident-*,logs-axonius.storage-*,logs-axonius.ticket-*,logs-axonius.application-*,logs-axonius.network-*,logs-axonius.identity-*,logs-axonius.exposure-*,logs-axonius.compute-*,logs-axonius.gateway-*,logs-axonius.user-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PR. As it ships transform pipeline too hence read, write permissions are also required. --------- (cherry picked from commit cba13bc) Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai>

…reams (#140046) (#140054) This PR focuses on the short term solution which add the logs-axonius.alert_and_incident-*,logs-axonius.storage-*,logs-axonius.ticket-*,logs-axonius.application-*,logs-axonius.network-*,logs-axonius.identity-*,logs-axonius.exposure-*,logs-axonius.compute-*,logs-axonius.gateway-*,logs-axonius.user-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PR. As it ships transform pipeline too hence read, write permissions are also required. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai> (cherry picked from commit cba13bc) # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

…reams (#140046) (#140055) This PR focuses on the short term solution which add the logs-axonius.alert_and_incident-*,logs-axonius.storage-*,logs-axonius.ticket-*,logs-axonius.application-*,logs-axonius.network-*,logs-axonius.identity-*,logs-axonius.exposure-*,logs-axonius.compute-*,logs-axonius.gateway-*,logs-axonius.user-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PR. As it ships transform pipeline too hence read, write permissions are also required. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai> (cherry picked from commit cba13bc) # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

…reams (#140046) (#140056) This PR focuses on the short term solution which add the logs-axonius.alert_and_incident-*,logs-axonius.storage-*,logs-axonius.ticket-*,logs-axonius.application-*,logs-axonius.network-*,logs-axonius.identity-*,logs-axonius.exposure-*,logs-axonius.compute-*,logs-axonius.gateway-*,logs-axonius.user-* indices under the kibana_system role with deletion privileges to prevent a failed deletion error when the index enters the deletion phase for the ILM lifecycle, in upcoming PR. As it ships transform pipeline too hence read, write permissions are also required. --------- Co-authored-by: muskan-crest <muskan.agarwal@crestdata.ai> (cherry picked from commit cba13bc) # Conflicts: # x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/KibanaOwnedReservedRoleDescriptors.java # x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

Added other datastreams of axonius in ilm_policy_delete_index

d41d188

muskan-agarwal26 requested a review from a team as a code owner December 30, 2025 06:50

muskan-agarwal26 requested a review from kc13greiner December 30, 2025 06:50

elasticsearchmachine added v9.4.0 needs:triage Requires assignment of a team area label external-contributor Pull request authored by a developer outside the Elasticsearch team labels Dec 30, 2025

Added changelog entry

2972bcf

ShourieG assigned ShourieG and muskan-agarwal26 Dec 30, 2025

elasticsearchmachine removed the needs:triage Requires assignment of a team area label label Dec 30, 2025

ShourieG added v9.3.0 v9.3.1 and removed v9.3.0 labels Dec 30, 2025

ShourieG approved these changes Dec 30, 2025

View reviewed changes

ShourieG merged commit cba13bc into elastic:main Dec 30, 2025
43 checks passed

muskan-agarwal26 mentioned this pull request Dec 30, 2025

[9.3] [axonius] - Fix Cannot execute ILM policy delete step in other datastreams (#140046) #140050

Merged

This was referenced Dec 30, 2025

[9.2] [axonius] - Fix Cannot execute ILM policy delete step in other datastreams (#140046) #140054

Merged

[9.1] [axonius] - Fix Cannot execute ILM policy delete step in other datastreams (#140046) #140055

Merged

muskan-agarwal26 mentioned this pull request Dec 30, 2025

[8.19] [axonius] - Fix Cannot execute ILM policy delete step in other datastreams (#140046) #140056

Merged

kcreddy mentioned this pull request Jan 2, 2026

[axonius][user] Add Axonius User datastream elastic/integrations#16142

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[axonius] - Fix Cannot execute ILM policy delete step in other datastreams#140046

[axonius] - Fix Cannot execute ILM policy delete step in other datastreams#140046
ShourieG merged 2 commits intoelastic:mainfrom
muskan-agarwal26:axonius-add_ilm_delete_index_feature

muskan-agarwal26 commented Dec 30, 2025

github-actions bot commented Dec 30, 2025

When to use applies_to tags:

What NOT to do:

elasticsearchmachine commented Dec 30, 2025

ShourieG commented Dec 30, 2025

ShourieG left a comment

ShourieG left a comment

Uh oh!

muskan-agarwal26 commented Dec 30, 2025

SiddharthMantri commented Dec 30, 2025

muskan-agarwal26 commented Dec 30, 2025

ShourieG commented Dec 31, 2025

SiddharthMantri commented Dec 31, 2025

Labels

5 participants

Conversation

muskan-agarwal26 commented Dec 30, 2025

github-actions bot commented Dec 30, 2025

ℹ️ Important: Docs version tagging

When to use applies_to tags:

What NOT to do:

🤔 Need help?

elasticsearchmachine commented Dec 30, 2025

ShourieG commented Dec 30, 2025

ShourieG left a comment

Choose a reason for hiding this comment

ShourieG left a comment

Choose a reason for hiding this comment

Uh oh!

muskan-agarwal26 commented Dec 30, 2025

💔 Some backports could not be created

Manual backport

Questions ?

SiddharthMantri commented Dec 30, 2025

muskan-agarwal26 commented Dec 30, 2025

💚 All backports created successfully

Questions ?

ShourieG commented Dec 31, 2025

SiddharthMantri commented Dec 31, 2025

Labels

5 participants