Elasticsearch privileges

This section provides detailed reference information for Elasticsearch privileges.

If you're using a stack-versioned deployment such as a self-managed cluster, Elastic Cloud Hosted, Elastic Cloud on Kubernetes, or Elastic Cloud Enterprise, then refer to User roles for more information on how role-based access control works.

If you're using Elastic Cloud Serverless, then refer to Serverless project custom roles to learn how to build roles using these privileges.

Note

In Elastic Cloud Serverless, Elastic manages the underlying infrastructure for you. Because of this, privileges related to cluster administration, scaling, snapshots, and availability are not available. Learn more about the features managed by Elastic Cloud Serverless.

Roles are governed by a set of configurable privileges grouped into these categories:

cluster, which you can use to manage core operations like snapshots, managing API keys, autoscaling, and cross-cluster functionality.
indices, which govern document-level access, index and data stream metadata information, and more.
run-as, which allows for secure impersonation.
application, which enable external applications to define and store their privilege models within Elasticsearch roles.

When creating roles, refer to this page for a complete list of available privileges.

Note

Privileges do not grant a fixed set of operations. Each privilege is defined by the action name patterns it matches, which means it automatically covers any new operations added to Elasticsearch in future releases that fall within its scope. For example, the all cluster privilege covers every cluster action, and manage covers all administrative actions — including new ones as they are introduced. The operations described for each privilege below are representative examples, not an exhaustive list.

Cluster privileges

all

All cluster administration operations, like snapshotting, node shutdown/restart, settings update, rerouting, or managing users and roles.

cancel_task

Privileges to cancel tasks and delete async searches. See delete async search API for more information.

create_snapshot Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to create snapshots for existing repositories. Can also list and view details on existing repositories and snapshots.

delegate_pki Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to delegate PKI authentication. Enables the use of the delegate PKI authentication API and to invalidate tokens.

cross_cluster_replication Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to connect to remote clusters configured with the API key based model for cross-cluster replication.

Note

This privilege must not be directly granted. It is used internally by Create Cross-Cluster API key and Update Cross-Cluster API key to manage cross-cluster API keys.

cross_cluster_search Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to connect to remote clusters configured with the API key based model for cross-cluster search.

Note

This privilege must not be directly granted. It is used internally by Create Cross-Cluster API key and Update Cross-Cluster API key to manage cross-cluster API keys.

grant_api_key Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to create Elasticsearch API keys on behalf of other users.

clone_api_key The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to clone an API key. Creates a new API key with the same permissions as an existing key, with a new name, ID, and optional expiration and metadata.

manage

Builds on monitor and adds cluster operations that change values in the cluster. This includes snapshotting, updating settings, and rerouting. It also includes obtaining snapshot and restore status. This privilege does not include the ability to manage security.

manage_api_key

All security-related operations on Elasticsearch REST API keys including creating new API keys, retrieving information about API keys, querying API keys, updating API key, bulk updating API keys, and invalidating API keys.

Note

When you create new API keys, they will always be owned by the authenticated user.
When you have this privilege, you can invalidate your own API keys and those owned by other users.

manage_autoscaling Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All operations related to managing autoscaling policies.

manage_behavioral_analytics Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All operations related to managing behavioral analytics collections, including creating, listing, and deleting collections.

manage_connector

All operations related to managing connectors and sync jobs, including creating, reading, updating, and deleting connector configurations, managing sync jobs, and updating connector settings such as filtering, scheduling, and pipelines. Does not grant access to connector secrets.

manage_ccr Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All cross-cluster replication operations related to managing follower indices and auto-follow patterns. It also includes the authority to grant the privileges necessary to manage follower indices and auto-follow patterns. This privilege is necessary only on clusters that contain follower indices.

manage_data_frame_transforms Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 7.5 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Use manage_transform instead. Elasticsearch version 7.5 and older used manage_data_frame_transforms in operations related to managing transforms.

manage_data_stream_global_retention Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 8.16 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

This privilege has no effect.

manage_enrich

All operations related to managing and executing enrich policies.

manage_ilm Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All index lifecycle management operations related to managing policies.

manage_index_templates

All operations on index templates.

manage_inference

All operations related to managing inference.

manage_ingest_pipelines

All operations on ingest pipelines.

manage_logstash_pipelines

All operations on logstash pipelines.

manage_ml

All machine learning operations, such as creating and deleting datafeeds, jobs, and model snapshots.

Note

Datafeeds that were created prior to version 6.2 or created when security features were disabled run as a system user with elevated privileges, including permission to read all indices. Newer datafeeds run with the security roles of the user who created or updated them.

manage_oidc Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Enables the use of Elasticsearch APIs (OpenID connect prepare authentication, OpenID connect authenticate, and OpenID connect logout) to initiate and manage OpenID Connect authentication on behalf of other users.

manage_own_api_key

All security-related operations on Elasticsearch API keys that are owned by the current authenticated user. The operations include creating new API keys, retrieving information about API keys, querying API keys, updating API key, bulk updating API keys, and invalidating API keys.

manage_pipeline

All operations on ingest pipelines.

manage_project_routing The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Unavailable This functionality is not available in Elastic Stack. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

All read and write operations on cross-project search project routing. Builds on read_project_routing by adding the ability to create and delete named project routing expressions.

manage_reindex Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

All operations on reindex tasks. This includes listing, getting status, cancelling, and rethrottling.

manage_rollup Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All rollup operations, including creating, starting, stopping and deleting rollup jobs.

manage_saml Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Enables the use of internal Elasticsearch APIs to initiate and manage SAML authentication on behalf of other users.

manage_search_application

All CRUD operations on search applications.

manage_search_query_rules

All CRUD operations on query rules.

manage_search_synonyms

All synonyms management operations on Synonyms APIs.

manage_security

All security-related operations such as CRUD operations on users and roles and cache clearing.

manage_service_account Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Security-related operations on Elasticsearch service accounts including Get service accounts, Create service account tokens, Delete service account token, and Get service account credentials.

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. This privilege grants token creation and deletion for Elastic-managed service accounts (in the elastic namespace) only. Managing user-managed service accounts and their tokens requires the manage_security privilege.

manage_slm Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 8.15 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

All snapshot lifecycle management (SLM) actions, including creating and updating policies and starting and stopping SLM. It also grants the permission to start and stop index lifecycle management, using the ILM start and ILM stop APIs.

In a future major release, this privilege will not grant any index lifecycle management permissions.

manage_token Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All security-related operations on tokens that are generated by the Elasticsearch Token Service.

manage_transform

All operations related to managing transforms.

manage_user_profile Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All operations on user profiles.

manage_watcher Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All watcher operations, such as putting watches, executing, activate or acknowledging.

Note

Watches that were created prior to version 6.1 or created when the security features were disabled run as a system user with elevated privileges, including permission to read and write all indices. Newer watches run with the security roles of the user who created or updated them.

monitor

All cluster read-only operations, like cluster health and state, hot threads, node info, node and cluster stats, and pending cluster tasks.

monitor_data_stream_global_retention The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 8.16 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. Unavailable This functionality is not available in Elastic Stack. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

This privilege has no effect.

monitor_connector

Read-only access to connector and sync job operations, including viewing connector configurations and sync job details.

monitor_enrich

All read-only operations related to managing and executing enrich policies.

monitor_esql The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

All read-only operations for listing and inspecting currently running ES|QL queries (GET /_query/queries and GET /_query/queries/{id}). This privilege does not grant the ability to run ES|QL queries or retrieve async query results. To run a query, you need the index read privilege on the queried indices.

monitor_inference

All read-only operations related to inference.

monitor_ml

All read-only machine learning operations, such as getting information about datafeeds, jobs, model snapshots, or results.

monitor_rollup Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All read-only rollup operations, such as viewing the list of historical and currently running rollup jobs and their capabilities.

monitor_reindex Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

All read-only operations on reindex tasks. This includes listing and getting status.

monitor_snapshot Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to list and view details on existing repositories and snapshots.

monitor_stats Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to list and view details of stats.

monitor_text_structure Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All read-only operations related to the find structure API.

monitor_transform

All read-only operations related to transforms.

monitor_watcher Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All read-only watcher operations, such as getting a watch and watcher stats.

post_behavioral_analytics_event Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privilege to post events to a behavioral analytics collection.

read_ccr Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All read-only cross-cluster replication operations, such as getting information about indices and metadata for leader indices in the cluster. It also includes the authority to check whether users have the appropriate privileges to follow leader indices. This privilege is necessary only on clusters that contain leader indices.

read_fleet_secrets Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Read-only access to Fleet secrets.

read_ilm Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All read-only index lifecycle management operations, such as getting policies and checking the status of {Ilm}

read_pipeline

Read-only access to ingest pipeline (get, simulate).

read_project_routing The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Unavailable This functionality is not available in Elastic Stack. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Read-only access to cross-project search project routing, including viewing project routing expressions and project metadata. Include read_project_routing for custom roles with the read index privilege to ensure users have access to the project picker in Kibana.

read_slm Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Deprecated since 8.15 This functionality is deprecated. You can still use it, but it'll be removed in a future Elastic Stack update. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

All read-only SLM actions, such as getting policies and checking the SLM status. It also grants the permission to get the index lifecycle management status, using the ILM get status API.

In a future major release, this privilege will not grant any index lifecycle management permissions.

read_security

All read-only security-related operations, such as getting users, user profiles, Elasticsearch API keys, Elasticsearch service accounts, roles and role mappings. Allows querying and retrieving information on all Elasticsearch API keys.

transport_client Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All privileges necessary for a transport client to connect. Required by the remote cluster to enable cross-cluster search.

write_connector_secrets Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privilege to create, update, and delete connector secrets.

write_fleet_secrets Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privilege to create and delete Fleet secrets.

Indices privileges

all

Any action on an index, data stream, or external dataset.

auto_configure

Permits auto-creation of indices and data streams. An auto-create action is the result of an index or bulk request that targets a non-existent index or data stream rather than an explicit create index or create data stream request. Also permits auto-update of mappings on indices and data streams if they do not contradict existing mappings. An auto-update mapping action is the result of an index or bulk request on an index or data stream that contains new fields that may be mapped rather than an explicit update mapping request.

create

Privilege to index documents.

Note

This privilege does not restrict the index operation to the creation of documents but instead restricts API use to the index API. The index API allows a user to overwrite a previously indexed document. See the create_doc privilege for an alternative.

Important

Don't use this privilege to update index mappings. That extra authority doesn't apply to data streams, has been deprecated since 8.0, and will be removed in a future major release. Grant the manage privilege for explicit mapping updates or the auto_configure privilege for automatic mapping updates.

create_dataset The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental in 9.5 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privilege to create or update an external dataset, granted on the dataset name. Refer to dataset privileges.

create_doc

Privilege to index documents. It does not grant the permission to update or overwrite existing documents.

Note

This privilege relies on the op_type of indexing requests (Index and Bulk). When ingesting documents as a user who has the create_doc privilege (and no higher privilege such as index or write), you must ensure that op_type is set to create through one of the following:

Explicitly setting the op_type in the index or bulk APIs
Using the _create endpoint for the index API
Creating a document with an auto-generated _id

Important

create_index

Privilege to create an index or data stream. A create index request may contain aliases to be added to the index once created. In that case the request requires the manage privilege as well, on both the index and the aliases names.

create_view The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview from 9.4 to 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Privilege to create or update an ES|QL view, granted on the view name. It does not grant the privilege to query the view, nor any access to the indices that the view definition references. Refer to view privileges.

Privileges to perform cross-cluster replication for indices located on remote clusters configured with the API key based model. This privilege should only be used for the privileges field of remote indices privileges.

cross_cluster_replication_internal Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privileges to perform supporting actions for cross-cluster replication from remote clusters configured with the API key based model.

Note

This privilege must not be directly granted. It is used internally by Create Cross-Cluster API key and Update Cross-Cluster API key to manage cross-cluster API keys.

delete

Privilege to delete documents.

delete_dataset The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental in 9.5 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privilege to delete an external dataset, granted on the dataset name. Refer to dataset privileges.

delete_index

Privilege to delete an index or data stream.

delete_view The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview from 9.4 to 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Privilege to delete an ES|QL view, granted on the view name. Refer to view privileges.

index

Privilege to index and update documents.

Important

maintenance

Permits refresh, flush, synced flush and force merge index administration operations. No privilege to read or write index data or otherwise manage the index.

manage

All monitor privileges plus index, data stream, and external dataset administration (aliases, analyze, cache clear, close, delete, exists, flush, mapping, open, field capabilities, force merge, refresh, settings, search shards, validate query).

manage_data_stream_lifecycle

All Data stream lifecycle operations relating to reading and managing the built-in lifecycle of a data stream. This includes operations such as adding and removing a lifecycle from a data stream.

manage_dataset The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental in 9.5 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privilege to create, update, retrieve, and delete external dataset definitions, granted on the dataset name. It does not grant the privilege to query a dataset with FROM. Refer to dataset privileges.

manage_failure_store The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

All monitor privileges plus index and data stream administration limited to failure stores only. Applies only to data streams when accessed through the index component selector syntax.

manage_follow_index Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All actions that are required to manage the lifecycle of a follower index, which includes creating a follower index, closing it, and converting it to a regular index. This privilege is necessary only on clusters that contain follower indices.

All index lifecycle management operations relating to managing the execution of policies of an index or data stream. This includes operations such as retrying policies and removing a policy from an index or data stream.

manage_leader_index Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

All actions that are required to manage the lifecycle of a leader index, which includes forgetting a follower. This privilege is necessary only on clusters that contain leader indices.

manage_view The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview from 9.4 to 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Privilege to create, update, retrieve, and delete ES|QL view definitions, granted on the view name. It does not grant the privilege to query a view with FROM, nor any access to the indices that a view definition references. Refer to view privileges.

monitor

All actions that are required for monitoring (recovery, segments info, index stats and status).

read

Read-only access to actions (count, explain, get, mget, get indexed scripts, more like this, multi percolate/search/termvector, percolate, scroll, clear_scroll, search, suggest, tv, ES|QL query, ES|QL views, async ES|QL get, and async ES|QL stop).

read_cross_cluster Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Read-only access to the search action from a remote cluster.

read_dataset_metadata The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental in 9.5 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Unavailable This functionality is not available in Elastic Cloud Serverless.

Privilege to retrieve an external dataset definition, granted on the dataset name. It does not grant the privilege to query the dataset. Refer to dataset privileges.

read_failure_store The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.1 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Read-only access to actions performed on a data stream's failure store. Required for access to failure store data (count, explain, get, mget, get indexed scripts, more like this, multi percolate/search/termvector, percolate, scroll, clear_scroll, search, suggest, tv). Applies only to data streams when accessed through the index component selector syntax.

read_view_metadata The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Preview from 9.4 to 9.5 This functionality is in technical preview and is ready for evaluation. Use with caution in production; it is not recommended for mission-critical workloads. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability Generally available This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Privilege to retrieve an ES|QL view definition, granted on the view name. It does not grant the privilege to query the view, nor any access to the indices that the view definition references. Refer to view privileges.

view_index_metadata

Read-only access to index and data stream metadata (aliases, exists, field capabilities, field mappings, get index, get data stream, ilm explain, mappings, search shards, settings, validate query). This privilege is available for use primarily by Kibana users.

write

Privilege to perform all write operations to documents, which includes the permission to index, update, and delete documents as well as performing bulk operations, while also allowing to dynamically update the index mapping.

Important

Don't use this privilege to update index mappings with the updating mapping API. That extra authority doesn't apply to data streams, has been deprecated since 8.0, and will be removed in a future major release. Grant the manage privilege for explicit mapping updates.

Run as privilege

The run_as permission enables an authenticated user to submit requests on behalf of another user. The value can be a user name or a comma-separated list of user names. (You can also specify users as an array of strings or a YAML sequence.) For more information, see Submitting requests on behalf of other users.

Application privileges

Application privileges are managed within Elasticsearch and can be retrieved with the has privileges API and the get application privileges API. They do not, however, grant access to any actions or resources within Elasticsearch. Their purpose is to enable applications to represent and store their own privilege models within Elasticsearch roles.

To create application privileges, use the add application privileges API. You can then associate these application privileges with roles, as described in Defining roles.