Closed
Description
Original comment by @tvernum:
See: https://discuss.elastic.co/t/what-is-the-security-realm-recommended-in-es-5-6/117841/3
refresh and _flush are currently part of manage which is a fairly destructive privilege (e.g. it includes delete, and close). However, flush and refresh are not destructive, and will eventually happen anyway, these APIs just trigger them earlier.
It would be good to have a high-level index privilege for refresh, and maybe flush (bearing in mind that flush is more expensive, and needed far less often).