Create a role and native user, change the password, issue an API key

Command

POST _security/role/log_okuma
{
  "cluster": ["monitor"],
  "indices": [
    { "names": ["log-*"], "privileges": ["read", "view_index_metadata"] }
  ]
}
POST _security/user/rapor_kullanici
{
  "password": "Degistir-123!",
  "roles": ["log_okuma"],
  "full_name": "Rapor Servisi"
}
GET _security/user/rapor_kullanici
# User making this request and its roles:
GET _security/_authenticate
POST _security/user/rapor_kullanici/_password
{
  "password": "Yeni-Sifre-456!"
}
# Time-limited API key with restricted privileges:
POST _security/api_key
{
  "name": "rapor-key",
  "expiration": "30d",
  "role_descriptors": { "log_okuma": { "indices": [ { "names": ["log-*"], "privileges": ["read"] } ] } }
}
# If the elastic user's password is lost (shell on a node):
# bin/elasticsearch-reset-password -u elastic -i

What it does

Creates a role with read access on an index pattern and a native realm user holding that role, changes the password, verifies the identity of the caller and issues a time-limited API key with narrowed privileges.

When to use it

When creating reporting, application or monitoring accounts with least privilege, during password rotation, and when moving services from users to API keys.

Caution

Do not use the elastic superuser in applications. An API key's privileges cannot exceed those of the user who created it; role_descriptors only narrow them. An API key is limited by a point-in-time snapshot of its owner's privileges at creation; later role changes do not affect existing keys. After a password change, services using the old password get 401; plan the cutover. The encoded value in the API key response is returned only once; store it.