How to fix SecurityException: action [indices:data/read/search] is unauthorized for user in Elasticsearch

ElasticsearchINTERMEDIATEMEDIUMUpdated Dec 22, 2025· 184 views

This security exception occurs when a user attempts to search an index without the required read privileges in their assigned role. The error indicates missing RBAC permissions for the search operation.

Quick fix

Fixes SecurityException: action [indices:data/read/search] is unauthorized for user

# Get user details and assigned roles
GET /_security/user/<username>
  1. Verify the user and their current roles
  2. Check the role privileges for the affected indices
  3. Grant read privileges to the user role
  4. Test the permissions
elasticsearch — error
# Get user details and assigned roles
GET /_security/user/<username>
SecurityException: action [indices:data/read/search] is unauthorized for user

What this error means

This error occurs when Elasticsearch's role-based access control (RBAC) system blocks a search request because the authenticated user lacks the necessary index privileges. The action "indices:data/read/search" represents the search operation on indices, and the security exception means the user's assigned roles do not include read permissions for the target index or indices. Elasticsearch security uses a permission model where users are assigned roles, and roles define what actions can be performed on which resources. When you see this error, it means the intersection of all the user's roles does not grant the "read" privilege for the index being queried. This commonly happens after enabling X-Pack security, when creating new users with limited roles, or when index permissions change but user roles are not updated accordingly. Even users with roles like "kibana_user" may encounter this if they don't have explicit read access to application indices.

Typical symptoms

  • Search queries return 403 Forbidden responses with security_exception
  • Kibana dashboards fail to load data from certain indices
  • API requests to _search endpoint are rejected with authorization errors
  • Users can authenticate successfully but cannot view any data
  • Error appears in Elasticsearch logs showing the specific action and user

Common causes

  1. User role does not include read or all privileges for the target index
  2. Role has index patterns that do not match the indices being searched
  3. User is assigned only basic roles like kibana_user without data access roles
  4. Index-level security was recently enabled but roles were not updated
  5. API key or service account lacks necessary search permissions
  6. Role privileges use field-level or document-level security that restricts access

How to fix "SecurityException: action [indices:data/read/search] is unauthorized for user"

1Verify the user and their current roles

First, identify which user is encountering the error and what roles they currently have assigned. Use the Security API to check:

bash
# Get user details and assigned roles
GET /_security/user/<username>

Or through Kibana:
1. Navigate to Management > Security > Users
2. Find the user and review their assigned roles
3. Note which roles are currently assigned

This will show you the starting point for diagnosing the permission issue.

2Check the role privileges for the affected indices

Examine what privileges the user's roles actually grant. For each role assigned to the user:

bash
# Get role details and index privileges
GET /_security/role/<role_name>

Look for the "indices" section in the response. You need to verify:
- Does any role include the target index name or a pattern that matches it?
- Do those matching patterns include "read" or "all" in the privileges array?

Example role with proper search permissions:

json
{
  "indices": [
    {
      "names": ["my-index-*"],
      "privileges": ["read"]
    }
  ]
}

If the index is not listed or the privileges don't include "read", this is your issue.

3Grant read privileges to the user role

If the user's roles lack read permissions, you need to either modify an existing role or create a new one with the proper privileges.

Option 1: Modify existing role via Kibana
1. Go to Management > Security > Roles
2. Select the role to edit
3. Under "Index privileges", add the index pattern
4. Select "read" privilege
5. Save the role

Option 2: Create new role via API

bash
POST /_security/role/my_search_role
{
  "indices": [
    {
      "names": ["my-index-*"],
      "privileges": ["read"]
    }
  ]
}

Then assign the role to the user:

bash
POST /_security/user/<username>/_password
{
  "roles": ["existing_role", "my_search_role"]
}

The user can now search indices matching the pattern.

4Test the permissions

After updating roles, verify the user can now perform searches:

bash
# Authenticate as the user and test search
curl -u username:password -X GET "localhost:9200/my-index/_search?pretty"

You should receive search results instead of a security exception. If using Kibana, refresh the page and try accessing the data again.

Troubleshooting: If the error persists:
- Verify the role was saved correctly with GET /_security/role/<role_name>
- Check that the index pattern actually matches your index names
- Ensure the user has the updated role list with GET /_security/user/<username>
- Wait a few moments for permission changes to propagate in the cluster

Advanced notes

Principle of Least Privilege: When granting permissions, use specific index patterns rather than wildcards like "*" to limit access to only necessary indices. Consider using time-based patterns (e.g., "logs-2025-*") for better security.

Document and Field Level Security: You can further restrict access using document-level security (DLS) with query filters or field-level security (FLS) to hide sensitive fields. These add additional authorization layers beyond basic read privileges.

API Keys: For applications and services, use API keys instead of user credentials. API keys inherit permissions from the user who creates them but can be more easily rotated and monitored:

bash
POST /_security/api_key
{
  "name": "my-api-key",
  "role_descriptors": {
    "my-app-role": {
      "indices": [
        {
          "names": ["my-index-*"],
          "privileges": ["read"]
        }
      ]
    }
  }
}

Reserved Indices: System indices like .security, .kibana, and other dot-prefixed indices have special protection. Regular roles cannot access them - only built-in roles like superuser can. Never grant broad access to these indices.

Monitoring Permission Issues: Enable audit logging to track authorization failures and understand which users are attempting unauthorized actions. Configure in elasticsearch.yml:

yaml
xpack.security.audit.enabled: true
xpack.security.audit.logfile.events.include: ["access_denied", "authentication_failed"]

Cross-Cluster Search: If searching remote clusters, the user needs both local permissions and the remote_indices privilege with appropriate cluster credentials configured.

Frequently asked questions

What does "SecurityException: action [indices:data/read/search] is unauthorized f" mean?
This error occurs when Elasticsearch's role-based access control (RBAC) system blocks a search request because the authenticated user lacks the necessary index privileges. The action "indices:data/read/search" represents the search operation on indices, and the security exception means the user's assigned roles do not include read permissions for the target index or indices. Elasticsearch security uses a permission model where users are assigned roles, and roles define what actions can be performed on which resources.
How do I fix "SecurityException: action [indices:data/read/search] is unauthorized f"?
This security exception occurs when a user attempts to search an index without the required read privileges in their assigned role. The error indicates missing RBAC permissions for the search operation.
What causes "SecurityException: action [indices:data/read/search] is unauthorized f"?
User role does not include read or all privileges for the target index Role has index patterns that do not match the indices being searched User is assigned only basic roles like kibana_user without data access roles
Is the "SecurityException: action [indices:data/read/search] is unauthorized f" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading