# Authorization issues Kibana

**URL:** <https://forum.search-guard.com/t/authorization-issues-kibana/409>\
**Category:** Search Guard\
**Created:** [March 7, 2017, 8:40pm UTC](https://forum.search-guard.com/t/authorization-issues-kibana/409 "2017-03-07T20:40:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![srikanth\_ramineni](https://avatars.discourse-cdn.com/v4/letter/s/aca169/32.png) [@srikanth\_ramineni](https://forum.search-guard.com/u/srikanth_ramineni)\
**Post date:** [March 7, 2017, 8:40pm UTC](https://forum.search-guard.com/t/authorization-issues-kibana/409/1 "2017-03-07T20:40:20Z")

</div>

Hi Team,

I am getting security exceptions in kibana for generic index patterns. could some one help to provide solution to this. Below is the use case.

I have below index patterns in ES and have permissions to users.

logstash\_iostats\_17756\_\* (\* indicates date) → Gave permissions to Srikanth

logstash\_iostats\_23857\_\* (\* indicates date) → Gave permissions to harish

In kibana I have set index pattern logstash\_iostats\_\* and created few visualizations and Dashboard.

when user srikanth logs in to kibana , it is giving security exception like indices-data.read.msearch ,indices-data.read.field\_stats but when I create index pattern logstash\_iostats\_17756\_\* then able to get data and not getting any issue.

Is searchguard support giving generic pattern in kibana logstash\_iostats\_\*, when user logs in get from specific index where user has access?

Thanks in advance for your help.

Thanks,

srikanth.

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [March 9, 2017, 3:43pm UTC](https://forum.search-guard.com/t/authorization-issues-kibana/409/2 "2017-03-09T15:43:23Z")

</div>

please share your sg\_roles.yml and sg\_action\_groups.yml

> **···**
>
> > Am 07.03.2017 um 21:40 schrieb srikanth ramineni \<ri.srikanth@gmail.com\>:
> > 
> > Hi Team,
> > 
> > I am getting security exceptions in kibana for generic index patterns. could some one help to provide solution to this. Below is the use case.
> > 
> > I have below index patterns in ES and have permissions to users.  
> > logstash\_iostats\_17756\_\* (\* indicates date) -\> Gave permissions to Srikanth  
> > logstash\_iostats\_23857\_\* (\* indicates date) -\> Gave permissions to harish
> > 
> > In kibana I have set index pattern logstash\_iostats\_\* and created few visualizations and Dashboard.
> > 
> > when user srikanth logs in to kibana , it is giving security exception like indices-data.read.msearch ,indices-data.read.field\_stats but when I create index pattern logstash\_iostats\_17756\_\* then able to get data and not getting any issue.
> > 
> > Is searchguard support giving generic pattern in kibana logstash\_iostats\_\*, when user logs in get from specific index where user has access?
> > 
> > Thanks in advance for your help.
> > 
> > Thanks,  
> > srikanth.
> > 
> > --  
> > You received this message because you are subscribed to the Google Groups "Search Guard" group.  
> > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.  
> > To post to this group, send email to search-guard@googlegroups.com.  
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/cf4403d3-8478-4c5b-824b-f90b513a0d71%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/cf4403d3-8478-4c5b-824b-f90b513a0d71%40googlegroups.com%5C).  
> > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).

---

<div class="post-metadata">

**Author:** ![srikanth\_ramineni](https://avatars.discourse-cdn.com/v4/letter/s/aca169/32.png) [@srikanth\_ramineni](https://forum.search-guard.com/u/srikanth_ramineni)\
**Post date:** [March 9, 2017, 4:21pm UTC](https://forum.search-guard.com/t/authorization-issues-kibana/409/3 "2017-03-09T16:21:57Z")

</div>

Hi,

Please find enclosed sg\_roles and sg\_action\_group files as you requested. Please let me know if you need more information.

Thanks,

Srikanth.

[sg\_action\_groups\_2017-Mar-06\_20-28-45.yml](https://forum.search-guard.com/uploads/short-url/p1NWcYJBPojSbcgVQqpecpLrlyz.yml) (1.46 KB)

[sg\_roles\_2017-Mar-06\_20-28-45.yml](https://forum.search-guard.com/uploads/short-url/xN3yVlcc0etXTXhQRMXNtYXSkyR.yml) (3.65 KB)

> **···**
>
> On Thursday, 9 March 2017 09:43:25 UTC-6, Search Guard wrote:
> 
> > please share your sg\_roles.yml and sg\_action\_groups.yml
> > 
> > > Am 07.03.2017 um 21:40 schrieb srikanth ramineni [ri.sr...@gmail.com](mailto:ri.sr...@gmail.com):
> > 
> > > Hi Team,
> > 
> > > I am getting security exceptions in kibana for generic index patterns. could some one help to provide solution to this. Below is the use case.
> > 
> > > I have below index patterns in ES and have permissions to users.
> > 
> > > logstash\_iostats\_17756\_\* (\* indicates date) → Gave permissions to Srikanth
> > 
> > > logstash\_iostats\_23857\_\* (\* indicates date) → Gave permissions to harish
> > 
> > > In kibana I have set index pattern logstash\_iostats\_\* and created few visualizations and Dashboard.
> > 
> > > when user srikanth logs in to kibana , it is giving security exception like indices-data.read.msearch ,indices-data.read.field\_stats but when I create index pattern logstash\_iostats\_17756\_\* then able to get data and not getting any issue.
> > 
> > > Is searchguard support giving generic pattern in kibana logstash\_iostats\_\*, when user logs in get from specific index where user has access?
> > 
> > > Thanks in advance for your help.
> > 
> > > Thanks,
> > 
> > > srikanth.
> > 
> > > –  
> > > You received this message because you are subscribed to the Google Groups “Search Guard” group.
> > 
> > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > 
> > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > 
> > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/cf4403d3-8478-4c5b-824b-f90b513a0d71%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/cf4403d3-8478-4c5b-824b-f90b513a0d71%40googlegroups.com).
> > 
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [March 22, 2017, 4:36pm UTC](https://forum.search-guard.com/t/authorization-issues-kibana/409/4 "2017-03-22T16:36:51Z")

</div>

What is your Search Guard and Elasticsearch version?

> **···**
>
> On Thursday, 9 March 2017 17:21:57 UTC+1, srikanth ramineni wrote:
> 
> > Hi,
> 
> > Please find enclosed sg\_roles and sg\_action\_group files as you requested. Please let me know if you need more information.
> 
> > 
> 
> > Thanks,
> 
> > Srikanth.
> > 
> > On Thursday, 9 March 2017 09:43:25 UTC-6, Search Guard wrote:
> > 
> > > please share your sg\_roles.yml and sg\_action\_groups.yml
> > > 
> > > > Am 07.03.2017 um 21:40 schrieb srikanth ramineni [ri.sr...@gmail.com](mailto:ri.sr...@gmail.com):
> > > 
> > > > Hi Team,
> > > 
> > > > I am getting security exceptions in kibana for generic index patterns. could some one help to provide solution to this. Below is the use case.
> > > 
> > > > I have below index patterns in ES and have permissions to users.
> > > 
> > > > logstash\_iostats\_17756\_\* (\* indicates date) → Gave permissions to Srikanth
> > > 
> > > > logstash\_iostats\_23857\_\* (\* indicates date) → Gave permissions to harish
> > > 
> > > > In kibana I have set index pattern logstash\_iostats\_\* and created few visualizations and Dashboard.
> > > 
> > > > when user srikanth logs in to kibana , it is giving security exception like indices-data.read.msearch ,indices-data.read.field\_stats but when I create index pattern logstash\_iostats\_17756\_\* then able to get data and not getting any issue.
> > > 
> > > > Is searchguard support giving generic pattern in kibana logstash\_iostats\_\*, when user logs in get from specific index where user has access?
> > > 
> > > > Thanks in advance for your help.
> > > 
> > > > Thanks,
> > > 
> > > > srikanth.
> > > 
> > > > –  
> > > > You received this message because you are subscribed to the Google Groups “Search Guard” group.
> > > 
> > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > > 
> > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > > 
> > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/cf4403d3-8478-4c5b-824b-f90b513a0d71%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/cf4403d3-8478-4c5b-824b-f90b513a0d71%40googlegroups.com).
> > > 
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [March 22, 2017, 4:39pm UTC](https://forum.search-guard.com/t/authorization-issues-kibana/409/5 "2017-03-22T16:39:56Z")

</div>

com\_att\_hfrunmonitor\_kibana:

cluster:

- “indices-data.read.msearch”

- “indices-data.read.searchANY”

- “indices-data.read.search”

seems to make no sense, it should be something like

com\_att\_hfrunmonitor\_kibana:

cluster:

- “indices:data/read/msearch”

- “indices:data/read/search”

> **···**
>
> On Thursday, 9 March 2017 17:21:57 UTC+1, srikanth ramineni wrote:
> 
> > Hi,
> 
> > Please find enclosed sg\_roles and sg\_action\_group files as you requested. Please let me know if you need more information.
> 
> > 
> 
> > Thanks,
> 
> > Srikanth.
> > 
> > On Thursday, 9 March 2017 09:43:25 UTC-6, Search Guard wrote:
> > 
> > > please share your sg\_roles.yml and sg\_action\_groups.yml
> > > 
> > > > Am 07.03.2017 um 21:40 schrieb srikanth ramineni [ri.sr...@gmail.com](mailto:ri.sr...@gmail.com):
> > > 
> > > > Hi Team,
> > > 
> > > > I am getting security exceptions in kibana for generic index patterns. could some one help to provide solution to this. Below is the use case.
> > > 
> > > > I have below index patterns in ES and have permissions to users.
> > > 
> > > > logstash\_iostats\_17756\_\* (\* indicates date) → Gave permissions to Srikanth
> > > 
> > > > logstash\_iostats\_23857\_\* (\* indicates date) → Gave permissions to harish
> > > 
> > > > In kibana I have set index pattern logstash\_iostats\_\* and created few visualizations and Dashboard.
> > > 
> > > > when user srikanth logs in to kibana , it is giving security exception like indices-data.read.msearch ,indices-data.read.field\_stats but when I create index pattern logstash\_iostats\_17756\_\* then able to get data and not getting any issue.
> > > 
> > > > Is searchguard support giving generic pattern in kibana logstash\_iostats\_\*, when user logs in get from specific index where user has access?
> > > 
> > > > Thanks in advance for your help.
> > > 
> > > > Thanks,
> > > 
> > > > srikanth.
> > > 
> > > > –  
> > > > You received this message because you are subscribed to the Google Groups “Search Guard” group.
> > > 
> > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com).
> > > 
> > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com).
> > > 
> > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/cf4403d3-8478-4c5b-824b-f90b513a0d71%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/cf4403d3-8478-4c5b-824b-f90b513a0d71%40googlegroups.com).
> > > 
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
