Creating a User for Log Sending

Security
1

Good morning everyone! I’m contacting you because I’m setting up OpenSearch via Docker in my infrastructure to capture logs for an application. However, I’m facing a problem that AI couldn’t help me with: I can only send logs to the application using the admin user.

With AI’s help, I tried to create another, more limited user (my goal is for this user to only send logs, with no access to anything else). I created a role called log-writer as follows:

curl -X PUT -u admin:'P@SsW0rD!' \
  "https://localhost:9200/_plugins/_security/api/roles/log-writer-role" \
  -H "Content-Type: application/json" \
  -d '{
    "cluster_permissions": [],
    "index_permissions": [
      {
        "index_patterns": ["logs-test", "logs-*"],
        "allowed_actions": [
          "write",
          "create_index",
          "create"
        ]
      }
    ]
  }' \
  --insecure

After that, I created the user using this role, but when I tried to add any logs, I received the following error:

curl -u log-writer:'P@SsW0rD!' \
  -X POST "https://localhost:9200/logs-test/_doc" \
  -H "Content-Type: application/json" \
  -d '{
    "timestamp": "'"$(date -Iseconds)"'",
    "message": "Teste de log de ingestão",
    "level": "INFO"
  }' \
  -k

{“error”:{“root_cause”:\[{“type”:“security_exception”,“reason”:“no permissions for \[indices:data/write/index\] and User \[name=log-writer, backend_roles=\[log-writer-role\], requestedTenant=null\]”}\],“type”:“security_exception”,“reason”:“no permissions for \[indices:data/write/index\] and User \[name=log-writer, backend_roles=\[log-writer-role\], requestedTenant=null\]”},“status”:403}

I’ve already added the indices:data/write/index permission to the role, and the problem persists.

Can anyone who has already documented this tell me what I need to do? My goal is to have a user with absolutely no access other than sending logs, so that if a leak occurs, the data present in the logs won’t leak.

2

@tacioandrade I’ve used your role and I was able to ingest document with your curl command

  1. Create a role
curl -X PUT -u admin:Eliatra123   "https://localhost:9200/_plugins/_security/api/roles/log-writer-role"   -H "Content-Type: application/json"   -d '{
    "cluster_permissions": [],
    "index_permissions": [
      {
        "index_patterns": ["logs-test", "logs-*"],
        "allowed_actions": [
          "write",
          "create_index",
          "create"
        ]
      }
    ]
  }'   --insecure

output:

{"status":"CREATED","message":"'log-writer-role' created."}
  1. Add user to a role
curl --insecure -XPUT -u admin:Eliatra123 "https://localhost:9200/_plugins/_security/api/internalusers/log-writer" -H 'Content-Type: application/json' -d'
{
  "password": "Eliatra123",
  "opendistro_security_roles": ["log-writer-role"]
}
'

output:

{"status":"CREATED","message":"'log-writer' created."}
  1. Ingest a document
curl -u log-writer:Eliatra123 \
  -X POST "https://localhost:9200/logs-test/_doc" \
  -H "Content-Type: application/json" \
  -d '{
    "timestamp": "'"$(date -Iseconds)"'",
    "message": "Teste de log de ingestão",
    "level": "INFO"
  }' \
  -k

output:

{"_index":"logs-test","_id":"eHM6upkB_MMuuqyUGjdM","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"_seq_no":0,"_primary_term":1}
  1. Search for an ingested doc.
curl --insecure -u admin:Eliatra123 https://localhost:9200/logs-test/_search?pretty

output:

{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "logs-test",
        "_id" : "eHM6upkB_MMuuqyUGjdM",
        "_score" : 1.0,
        "_source" : {
          "timestamp" : "2025-10-06T15:53:13+00:00",
          "message" : "Teste de log de ingestão",
          "level" : "INFO"
        }
      }
    ]
  }
}
1 Like
3

@tacioandrade Check if the your test user has the role assigned.

curl --insecure -u log-writer:'P@SsW0rD!' https://localhost:9200/_plugins/_security/authinfo?pretty
4

My friend, thank you so much! I don’t know where I was going wrong, but what you gave me seems to have solved the problem.

I’ll run some tests this week and if I’ve actually resolved it, I’ll come back here and mark it as solved.

Best regards, and have a great week.

1 Like