@ÖzhanA56

Give the Elasticsearch user only what SRS needs. At the cluster level, grant monitor (so SRS can check health) and the abilities to manage index templates and ILM if you use them (manage_index_templates, manage_ilm). At the index level, scope permissions to your SRS index prefix (not all indices): create_index, write, read, delete, delete_by_query, manage, manage_aliases, and manage_settings. If you use ingest pipelines, add manage_ingest_pipelines. Do not give superuser or indices:* on everything; keep it to the SRS prefix you configure. Rotate the credentials and enable TLS on transport/http. This aligns with SRS externalization guidance and Elasticsearch’s documented privilege model.