How to fix AccessDeniedException: action [cluster:admin/settings/update] is unauthorized in Elasticsearch

First, determine which user is encountering the error and what roles they are assigned. You can check this in Kibana:

1. Go to Management > Stack Management > Security > Users
2. Click on the user experiencing the error
3. Note the roles listed in the Roles section

Alternatively, use the Elasticsearch API:

GET /_security/user/{username}

Add the cluster:admin/settings/update privilege to the user's role. In Kibana:

1. Go to Management > Stack Management > Security > Roles
2. Click on the role assigned to the user
3. Under Cluster privileges, add cluster:admin/settings/update
4. Save the role

Or use the Elasticsearch API to create or update a role:

POST /_security/role/custom_admin_role
{
  "cluster": ["cluster:admin/settings/update", "cluster:monitor"],
  "indices": [
    {
      "names": ["*"],
      "privileges": ["manage", "read", "write"]
    }
  ]
}

If this error occurred while enabling monitoring, ensure the user has both cluster:admin/settings/update and the ability to manage monitoring. Create a monitoring role with:

POST /_security/role/monitoring_admin
{
  "cluster": [
    "cluster:admin/settings/update",
    "cluster:monitor",
    "cluster:manage/logstash/pipeline/get"
  ],
  "indices": [
    {
      "names": [".monitoring-*"],
      "privileges": ["manage", "read", "write"]
    }
  ]
}

If the error occurs during ILM policy rollover or updates, the user needs both cluster and index-level permissions:

POST /_security/role/ilm_admin
{
  "cluster": ["manage_ilm", "cluster:admin/settings/update"],
  "indices": [
    {
      "names": ["*"],
      "privileges": ["manage", "manage_ilm"]
    }
  ]
}

After updating the role, verify that the user can now perform the operation. Test by:

1. Logging out and back in as the affected user
2. Attempting the operation that previously failed
3. Checking Kibana > Stack Management > Monitoring to confirm monitoring is now enabled (if applicable)
4. Running a cluster settings API call:

GET /_cluster/settings
PUT /_cluster/settings
{
  "transient": {
    "xpack.monitoring.collection.enabled": true
  }
}