Failed to index audit event anonymous access denied – How to solve this Elasticsearch error

Opster Team

Aug-23, Version: 6.8-6.8

Briefly, this error occurs when Elasticsearch tries to index an audit event but fails due to anonymous access being denied. This could be due to incorrect permissions or anonymous access not being enabled. To resolve this issue, you can either enable anonymous access in the Elasticsearch configuration file or ensure that the user or role trying to index the audit event has the necessary permissions. Additionally, check your cluster health and ensure that your indices are not in a read-only state.

This guide will help you check for common problems that cause the log ” failed to index audit event: [anonymous_access_denied] ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin, index.

Log Context

Log “failed to index audit event: [anonymous_access_denied]” classname is
We extracted the following from Elasticsearch source code for those seeking an in-depth context :

        if (events.contains(ANONYMOUS_ACCESS_DENIED)) {
            try {
                enqueue(message("anonymous_access_denied"; action; (User) null; null; null; indices(message); message);
            } catch (Exception e) {
                logger.warn("failed to index audit event: [anonymous_access_denied]"; e);