# Search Guard **URL:** https://forum.search-guard.com/c/search-guard/11.md?page=3 [Latest](https://forum.search-guard.com/latest.md) · [Categories](https://forum.search-guard.com/categories.md) · [Tags](https://forum.search-guard.com/tags.md) **Page:** 4 --- ## [\[c.f.s.a.r.AuthenticatingRestFilter\] \[node1\] Not yet initialized (you may need to run sgctl)](https://forum.search-guard.com/t/c-f-s-a-r-authenticatingrestfilter-node1-not-yet-initialized-you-may-need-to-run-sgctl/2433)
**Author:** [@landon\_jt](https://forum.search-guard.com/u/landon_jt)\ **Replies:** 10\ **Last updated:** [May 5, 2023, 7:03pm UTC](https://forum.search-guard.com/t/c-f-s-a-r-authenticatingrestfilter-node1-not-yet-initialized-you-may-need-to-run-sgctl/2433 "2023-05-05T19:03:11Z")
ElasticSearch Version: elasticsearch-8.6.2-1.x86\_64 Logstash Version: logstash-oss-8.6.2-1.x86\_64 Kibana Version: kibana-8.6.2-1.x86\_64 Searchguard Version: search-guard-flx-elasticsearch-plugin-1.1.1-es-8.6.2.zip s… --- ## [Kibana licence issue](https://forum.search-guard.com/t/kibana-licence-issue/2428)
**Author:** [@theo](https://forum.search-guard.com/u/theo)\ **Replies:** 9\ **Last updated:** [April 24, 2023, 11:11am UTC](https://forum.search-guard.com/t/kibana-licence-issue/2428 "2023-04-24T11:11:58Z")
Hi, i have an issue when i try to start my kibana (it’s the same error with or without the plugins searchguard installed in my Kibana VM). I don’t have a licence for search guard so i try to install it without the enterp… --- ## [No permissions for \[indices:admin/mapping/auto\_put\]](https://forum.search-guard.com/t/no-permissions-for-indices-admin-mapping-auto-put/2427)
**Author:** [@faxmodem](https://forum.search-guard.com/u/faxmodem)\ **Replies:** 13\ **Last updated:** [April 20, 2023, 7:09am UTC](https://forum.search-guard.com/t/no-permissions-for-indices-admin-mapping-auto-put/2427 "2023-04-20T07:09:10Z")
Hi, Still using 7.10.2-53.1.0 we’re faced with the following kibana issue: users with tenant permissions SGS\_KIBANA\_ALL\_WRITE and role SGS\_KIBANA\_USER can’t save searches in tenant X: no permissions for \[indices:admin… --- ## [Nable to connect to ldapserver due to OpenSearchException\[Empty file path for plugins.security.ssl.transport.truststore\_filepath\]. Try next](https://forum.search-guard.com/t/nable-to-connect-to-ldapserver-due-to-opensearchexception-empty-file-path-for-plugins-security-ssl-transport-truststore-filepath-try-next/2430)
**Author:** [@Yorlov](https://forum.search-guard.com/u/Yorlov)\ **Replies:** 1\ **Last updated:** [April 7, 2023, 8:52pm UTC](https://forum.search-guard.com/t/nable-to-connect-to-ldapserver-due-to-opensearchexception-empty-file-path-for-plugins-security-ssl-transport-truststore-filepath-try-next/2430 "2023-04-07T20:52:57Z")
hello community , im trying to configure opensearch with ldaps it says unable to connect to ldapserver due to OpenSearchException\[Empty file path for plugins.security.ssl.transport.truststore\_filepath\].Try next , this … --- ## [I'm trying to create a watcher that match my log field](https://forum.search-guard.com/t/im-trying-to-create-a-watcher-that-match-my-log-field/2423)
**Author:** [@pramilaniroshan](https://forum.search-guard.com/u/pramilaniroshan)\ **Replies:** 5\ **Last updated:** [April 6, 2023, 9:06am UTC](https://forum.search-guard.com/t/im-trying-to-create-a-watcher-that-match-my-log-field/2423 "2023-04-06T09:06:06Z")
Hi all, when creating a kibana rule we have a option called Log threshold(attched) and using that we can compare a custom log4j field(client\_email) count . can I do the same logic using search guard watcher? please hel… --- ## [Failing license installation](https://forum.search-guard.com/t/failing-license-installation/2426)
**Author:** [@fbacchella](https://forum.search-guard.com/u/fbacchella)\ **Replies:** 3\ **Last updated:** [April 4, 2023, 6:04pm UTC](https://forum.search-guard.com/t/failing-license-installation/2426 "2023-04-04T18:04:24Z")
Elasticsearch version: 7.17.9 Server OS version: CentOS Linux release 8.5.2111 Search Guard version: 53.6.0 When trying to install the license using sgadmin, it fails with: FAIL: Expected 7 config types for node X… --- ## [Error with enable\_openssl\_if\_available when using sgadmin.sh](https://forum.search-guard.com/t/error-with-enable-openssl-if-available-when-using-sgadmin-sh/2424)
**Author:** [@Thomas](https://forum.search-guard.com/u/Thomas)\ **Replies:** 7\ **Last updated:** [April 3, 2023, 3:40pm UTC](https://forum.search-guard.com/t/error-with-enable-openssl-if-available-when-using-sgadmin-sh/2424 "2023-04-03T15:40:58Z")
Elasticsearch version: 7.17.9 Server OS version: Docker with official Elasticsearch Image Kibana version (if relevant): 7.17.9 Describe the issue: Hello, i’m trying to install Search Guard on an ElasticSearch/Kibana … --- ## [Cannot Find License Agreements](https://forum.search-guard.com/t/cannot-find-license-agreements/2425)
**Author:** [@Kosmonafft](https://forum.search-guard.com/u/Kosmonafft)\ **Replies:** 1\ **Last updated:** [March 31, 2023, 2:05pm UTC](https://forum.search-guard.com/t/cannot-find-license-agreements/2425 "2023-03-31T14:05:59Z")
Hi. I have hard time to find SG License Agreements. Can someone point me to it? --- ## [Filebeat and Metricbeat on remote servers will not connect](https://forum.search-guard.com/t/filebeat-and-metricbeat-on-remote-servers-will-not-connect/2421)
**Author:** [@silentfilm](https://forum.search-guard.com/u/silentfilm)\ **Replies:** 2\ **Last updated:** [March 24, 2023, 1:12pm UTC](https://forum.search-guard.com/t/filebeat-and-metricbeat-on-remote-servers-will-not-connect/2421 "2023-03-24T13:12:31Z")
Elasticsearch version: 7.17.9 Describe the issue: I have upgraded my Elasticsearch server, Kibana, Filebeat, Metricbeat, and SearchGuard to version 7.17.9 from 7.9.3. We are not using the FLX version of SearchGuard. … --- ## [com.floragunn.searchguard.filter.SearchGuardRestFilter error](https://forum.search-guard.com/t/com-floragunn-searchguard-filter-searchguardrestfilter-error/2413)
**Author:** [@silentfilm](https://forum.search-guard.com/u/silentfilm)\ **Replies:** 2\ **Last updated:** [March 23, 2023, 7:39pm UTC](https://forum.search-guard.com/t/com-floragunn-searchguard-filter-searchguardrestfilter-error/2413 "2023-03-23T19:39:25Z")
I am occastionally getting the following Elasticsearch search-guard error, but there are no other log messages around it that provide any more information. I can’t even find an application that is obviously failing when … --- ## [I have Search Guard Installed with ELK 7.17.3 Version , need to make it https](https://forum.search-guard.com/t/i-have-search-guard-installed-with-elk-7-17-3-version-need-to-make-it-https/2420)
**Author:** [@amalk12](https://forum.search-guard.com/u/amalk12)\ **Replies:** 5\ **Last updated:** [March 23, 2023, 9:58am UTC](https://forum.search-guard.com/t/i-have-search-guard-installed-with-elk-7-17-3-version-need-to-make-it-https/2420 "2023-03-23T09:58:16Z")
If you think it is a bug report or you have a technical issue, please answer the following questions. For general questions, you can delete these questions. Elasticsearch version: 7.17.3 Server OS version: Windows 2019 … --- ## [I am trying to create users in Search guard so they can login to Kibana](https://forum.search-guard.com/t/i-am-trying-to-create-users-in-search-guard-so-they-can-login-to-kibana/2397)
**Author:** [@amalk12](https://forum.search-guard.com/u/amalk12)\ **Replies:** 9\ **Last updated:** [March 21, 2023, 12:40am UTC](https://forum.search-guard.com/t/i-am-trying-to-create-users-in-search-guard-so-they-can-login-to-kibana/2397 "2023-03-21T00:40:01Z")
If you think it is a bug report or you have a technical issue, please answer the following questions. For general questions, you can delete these questions. Elasticsearch version: 7.17.3 Server OS version: Windows 2019 … --- ## [Missing tenant index](https://forum.search-guard.com/t/missing-tenant-index/2416)
**Author:** [@faxmodem](https://forum.search-guard.com/u/faxmodem)\ **Replies:** 7\ **Last updated:** [March 20, 2023, 9:17am UTC](https://forum.search-guard.com/t/missing-tenant-index/2416 "2023-03-20T09:17:58Z")
In SG 7.10.2-53.1.0 we have an issue where we created a new tenant, and the kibana indices are not being created: A REST API call to \_cat/indices/.kibana\* confirms this. What could be the cause of the absent kibana i… --- ## [Search Guard FLX 1.1.0 Kibana error](https://forum.search-guard.com/t/search-guard-flx-1-1-0-kibana-error/2415)
**Author:** [@korodif](https://forum.search-guard.com/u/korodif)\ **Replies:** 12\ **Last updated:** [March 16, 2023, 3:49pm UTC](https://forum.search-guard.com/t/search-guard-flx-1-1-0-kibana-error/2415 "2023-03-16T15:49:12Z")
Hi! After installing the elasticsearch and kibana Search Guard plugin, and initializing Search Guard with sgctl the kibana GUI is not reachable. The kibana log file contains the following error: kibana\[3361368\]: \[2023-… --- ## [Kibana 7.17.7 & openid 'redirect\_uri' parameter is not a valid](https://forum.search-guard.com/t/kibana-7-17-7-openid-redirect-uri-parameter-is-not-a-valid/2394)
**Author:** [@peter82](https://forum.search-guard.com/u/peter82)\ **Replies:** 4\ **Last updated:** [February 27, 2023, 10:46am UTC](https://forum.search-guard.com/t/kibana-7-17-7-openid-redirect-uri-parameter-is-not-a-valid/2394 "2023-02-27T10:46:25Z")
Elasticsearch version: 7.17.7 , same as kibana, FLX 1.1.0 according documentation we should use server.publicBaseUrl instead of searchguard.frontend\_base\_url but it doesnt work. Kibana OIDC Quick Start | Security for… --- ## [CVE-2022-46364 | GHSA-x3x3-qwjq-8gj4 Security Issue on SearchGuard](https://forum.search-guard.com/t/cve-2022-46364-ghsa-x3x3-qwjq-8gj4-security-issue-on-searchguard/2398)
**Author:** [@arthurpapanyan](https://forum.search-guard.com/u/arthurpapanyan)\ **Replies:** 1\ **Last updated:** [February 20, 2023, 4:29pm UTC](https://forum.search-guard.com/t/cve-2022-46364-ghsa-x3x3-qwjq-8gj4-security-issue-on-searchguard/2398 "2023-02-20T16:29:26Z")
Our security scanner reports these packages as vulnerable. With Critical Severity. these packages are used by searchguard. Package: search-guard-7/cxf-\* ./elasticsearch/plugins/search-guard-7/cxf-rt-security-3.3.11.jar … --- ## [About the new FLX location of krb5\_filepath](https://forum.search-guard.com/t/about-the-new-flx-location-of-krb5-filepath/2405)
**Author:** [@faxmodem](https://forum.search-guard.com/u/faxmodem)\ **Replies:** 2\ **Last updated:** [February 16, 2023, 11:29am UTC](https://forum.search-guard.com/t/about-the-new-flx-location-of-krb5-filepath/2405 "2023-02-16T11:29:14Z")
The sgctl tool instructs us to move the acceptor\_principal and acceptor\_keytab from elasticsearch.yml to sgconfig’s sg\_authc.yml. However, there is no mention of the krb5\_filepath option. Should that stay in elasticsear… --- ## [Authentication failed for null](https://forum.search-guard.com/t/authentication-failed-for-null/2404)
**Author:** [@faxmodem](https://forum.search-guard.com/u/faxmodem)\ **Replies:** 3\ **Last updated:** [February 16, 2023, 8:39am UTC](https://forum.search-guard.com/t/authentication-failed-for-null/2404 "2023-02-16T08:39:42Z")
We’re using search-guard-flx 1.0.0-es-7.10.2 on one of our test clusters, and for some reason the internal users all get 401’s for any request e.g. / or /\_searchguard/authinfo: HTTP/1.1 401 Unauthorized WWW-Authenticate… --- ## [Create custum roles for external Users (AD users)](https://forum.search-guard.com/t/create-custum-roles-for-external-users-ad-users/2403)
**Author:** [@Aymen](https://forum.search-guard.com/u/Aymen)\ **Replies:** 4\ **Last updated:** [February 16, 2023, 8:00am UTC](https://forum.search-guard.com/t/create-custum-roles-for-external-users-ad-users/2403 "2023-02-16T08:00:53Z")
Hello, I’m new in Searchguard, and i would like to ask how to assign a Search Guard role to a user in an Active Directory management system (Limit access for some aD users only to some indices). Is that Possible Note: … --- ## [Where is the source code of FLX?](https://forum.search-guard.com/t/where-is-the-source-code-of-flx/2402)
**Author:** [@faxmodem](https://forum.search-guard.com/u/faxmodem)\ **Replies:** 2\ **Last updated:** [February 14, 2023, 5:01pm UTC](https://forum.search-guard.com/t/where-is-the-source-code-of-flx/2402 "2023-02-14T17:01:55Z")
I’m confused as where to find the source code of FLX. I already have access to search-guard-suite but I believe this is old coffee. Thanks --- ## [CVE-2021-38153 Security issue in Searchguard package](https://forum.search-guard.com/t/cve-2021-38153-security-issue-in-searchguard-package/2399)
**Author:** [@arthurpapanyan](https://forum.search-guard.com/u/arthurpapanyan)\ **Replies:** 1\ **Last updated:** [February 10, 2023, 9:29am UTC](https://forum.search-guard.com/t/cve-2021-38153-security-issue-in-searchguard-package/2399 "2023-02-10T09:29:23Z")
Our Security scans detected Security vulnerability on package that is used in serchgurad. Could you please upgrade this package to resolve the issue, state that Searchguard is not vulnerable with this. Describe the iss… --- ## [Helm installation fails](https://forum.search-guard.com/t/helm-installation-fails/2396)
**Author:** [@erniMJ](https://forum.search-guard.com/u/erniMJ)\ **Replies:** 1\ **Last updated:** [February 9, 2023, 10:17pm UTC](https://forum.search-guard.com/t/helm-installation-fails/2396 "2023-02-09T22:17:42Z")
Hello Team, I tried to install search-gourd using helm chart download from official helm repo. I am using following required tools: kubectl client 1.20.0 kubectl server 1.23.12 helm: 3.11 When I I try to install hel… --- ## [How are roles combined?](https://forum.search-guard.com/t/how-are-roles-combined/2395)
**Author:** [@faxmodem](https://forum.search-guard.com/u/faxmodem)\ **Replies:** 2\ **Last updated:** [January 27, 2023, 9:16am UTC](https://forum.search-guard.com/t/how-are-roles-combined/2395 "2023-01-27T09:16:08Z")
We noticed a case where one of a user’s role masked another. The user was able to search in one index only if we removed the other roles. The documentation states the following : A request can be assigned to one or mo… --- ## [Pipeline management restrictions](https://forum.search-guard.com/t/pipeline-management-restrictions/2386)
**Author:** [@faxmodem](https://forum.search-guard.com/u/faxmodem)\ **Replies:** 10\ **Last updated:** [January 26, 2023, 12:57pm UTC](https://forum.search-guard.com/t/pipeline-management-restrictions/2386 "2023-01-26T12:57:55Z")
Hi, We have a new request from a user who wants to use Filebeat in our multi-tenant cluster. The problem is, that Filebeat is trying to create Index Templates and Pipelines, which we restricted due to the multi-tenant … --- ## [How to initialize SG using sgctl?](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393)
**Author:** [@Kosmonafft](https://forum.search-guard.com/u/Kosmonafft)\ **Replies:** 9\ **Last updated:** [January 24, 2023, 3:52pm UTC](https://forum.search-guard.com/t/how-to-initialize-sg-using-sgctl/2393 "2023-01-24T15:52:10Z")
Hi, I am struggeling to find the exact command to initialize my cluster using SG FLX. I executed ./sgctl.sh connect, but still have in my logs: Not yet initialized (you may need to run sgctl) The documentation leads … --- ## [High cpu usage after ES update to 7.17.7](https://forum.search-guard.com/t/high-cpu-usage-after-es-update-to-7-17-7/2387)
**Author:** [@Ossenfeld](https://forum.search-guard.com/u/Ossenfeld)\ **Replies:** 9\ **Last updated:** [January 3, 2023, 12:27pm UTC](https://forum.search-guard.com/t/high-cpu-usage-after-es-update-to-7-17-7/2387 "2023-01-03T12:27:46Z")
Elasticsearch version: 7.17.7 Server OS version: SUSE Linux Enterprise Server 15 SP3 Kibana version (if relevant): 7.17.7 Describe the issue: Hello, after an update from 7.16.2 to 7.17.7, we’re experiencing about do… --- ## [About adding users to a role mapping using the API](https://forum.search-guard.com/t/about-adding-users-to-a-role-mapping-using-the-api/2379)
**Author:** [@faxmodem](https://forum.search-guard.com/u/faxmodem)\ **Replies:** 9\ **Last updated:** [December 19, 2022, 10:03am UTC](https://forum.search-guard.com/t/about-adding-users-to-a-role-mapping-using-the-api/2379 "2022-12-19T10:03:05Z")
Hi, I’m trying to add a user to a role mapping using the API. I’m probably mis-understanding the PATCH method, so maybe someone can explain what’s going on here: ☠ ES GET \_searchguard/api/rolesmapping/sg\_role\_test HTT… --- ## [Search Guard FLX DLS/FLS breaks Kibana multi-tenancy](https://forum.search-guard.com/t/search-guard-flx-dls-fls-breaks-kibana-multi-tenancy/2369)
**Author:** [@trauta](https://forum.search-guard.com/u/trauta)\ **Replies:** 20\ **Last updated:** [December 16, 2022, 1:27pm UTC](https://forum.search-guard.com/t/search-guard-flx-dls-fls-breaks-kibana-multi-tenancy/2369 "2022-12-16T13:27:34Z")
Hi, When using the new FLX implementation for DLS/FLS security the multi-tenancy feature in Kibana seems to be broken. After setting use\_impl: flx in sg\_authz\_dlsfls.yml a logged in user in Kibana gets a HTTP 500 Inter… --- ## [OIDC - obtain roles using userinfo endpoint](https://forum.search-guard.com/t/oidc-obtain-roles-using-userinfo-endpoint/1826)
**Author:** [@shakazulu](https://forum.search-guard.com/u/shakazulu)\ **Replies:** 7\ **Last updated:** [December 15, 2022, 10:15am UTC](https://forum.search-guard.com/t/oidc-obtain-roles-using-userinfo-endpoint/1826 "2022-12-15T10:15:41Z")
Hello all! I am trying to configure OIDC integration with elasticsearch and kibana. For development, I am using my own IdP based on KeyCloak. Everything works fine. Roles are read out of the JWT Token if I configure Ke… --- ## [No permissions for \[indices:data/read/search\]](https://forum.search-guard.com/t/no-permissions-for-indices-data-read-search/2380)
**Author:** [@hello4usharath](https://forum.search-guard.com/u/hello4usharath)\ **Replies:** 3\ **Last updated:** [December 12, 2022, 9:33am UTC](https://forum.search-guard.com/t/no-permissions-for-indices-data-read-search/2380 "2022-12-12T09:33:55Z")
No index-level perm match for User sg\_anonymous \[backend\_roles=\[sg\_anonymous\_backendrole\]\] Resolved \[aliases=\[.kibana\_7.17.7\], indices=, allIndices=\[.kibana\_7.17.7\_001\], types=\[\*\], originalRequested=\[.kibana\_7.17.7\], re… [Previous page](https://forum.search-guard.com/c/search-guard/11.md?page=2) [Next page](https://forum.search-guard.com/c/search-guard/11.md?page=4)