ES X-Pack Security: Bootstraping graylog as unprivileged user fails. Operation as unprivileged user is fine.

Recently I've observed what I consider to be unexpected behaviour while bootstraping graylog as an unprivileged user.

Here is a link to the troubleshooting I already made:

## Expected Behavior
Graylog should create the correct templates, indices and aliases with a user that can only access indices with a cretain prefix, this would allow for easy setup of multitenant ES clusters with several graylog clients.

## Current Behavior

while bootstraping as an unprivileged user:

1. graylog fails to create the `graylog-internal` template
2. graylog creates an index suffixed with `deflector` ex: `graylogdev_default_deflector`.

while bootstraping as privileged `elastic` user:

1. graylog creates the `graylog-internal` template
2. graylog creates an index suffixed with a number ex: `graylogdev_default_0`.

after bootstraping I can switch to an unprivileged user:

1. index set creation results in the correct creation of a new template
2. a new index is correctly created, suffixed with a number ex: `graylogdev_new_0`.

## Possible Solution
It would be nice to know exactly what are the strictly required privileges to have graylog using an ES cluster as an unprivileged user.

## Steps to Reproduce (for bugs)

The troubleshooting I already made:

https://community.graylog.org/t/unusual-behaviour-while-using-elasticsearch-non-super-user/11355/1

## Context
This is preventing the design of a multitenant ES cluster solution, where every user would not be able to access any index not explicitely allow by an administrator.

This was encountered when attempting to implement authentication and authorization for the ES cluster by creating a user with restricted index use permissions.

## Environment

* Graylog Version: 3.0.2
* Elasticsearch Version: 6.8
* MongoDB Version: 3.6.13
* Operating System: CentOS 7