You can mark any index in Elasticsearch as immutable. Documents in immutable indices follow the write-once, read-many paradigm. This means that you can create documents, but once created, they cannot be changed anymore, thus making them immutable.
To mark an index immutable, list the index name in elasticsearch.yml like:
searchguard.compliance.immutable_indices: - indexA - indexB - ...
Marking an index immutable prevents the following actions from being executed:
- Changing or deleting any existing document
- this also includes bulk operations
- Deleting the index
- Opening anc closing the index
- Performing a reindex
- Snapshot / restore
Using an admin certificate
A configured TLS admin certificate can be used to bypass the immutable index checks.
Search Guard tracks attempts to immutable indices in the auditlog:
|Category||Logged on REST||Logged on Transport||Description|
|COMPLIANCE_IMMUTABLE_INDEX_ATTEMPT||yes||yes||Attempt to access and immutable index in a way which is not allowed.|