"Elasticsearch has no concept of a user. Essentially, anyone that can send arbitrary requests to your cluster is a “super user”. " https://www.elastic.co/de/bl

"Elasticsearch has no concept of a user. Essentially, anyone that can send arbitrary requests to your cluster is a “super user”. " https://www.elastic.co/de/blog/found-elasticsearch-security https://www.elastic.co/de/blog/found-elasticsearch-security This document says it twice verbatim - once as an emphasizes blurb of its own. It is also re-emphasized it in several other ways. (same link as also posted by the Elasticsearch employee above).