# Blacklist Indices

**URL:** <https://forum.search-guard.com/t/blacklist-indices/1469>\
**Category:** Search Guard\
**Created:** [May 3, 2019, 5:57pm UTC](https://forum.search-guard.com/t/blacklist-indices/1469 "2019-05-03T17:57:23Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Doug\_Renze](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/doug_renze/32/720_2.png) [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\
**Post date:** [May 3, 2019, 5:57pm UTC](https://forum.search-guard.com/t/blacklist-indices/1469/1 "2019-05-03T17:57:23Z")

</div>

I have a requirement to restrict access to specific indices. Once I worked through some previous issues, I have no problems granting access for those indices to the specific groups I want to grant access to.

However, for the remaining indices (the ones which should be accessible to everyone), I want to simply blacklist the restricted indices, in order to avoid the headache of having to whitelist each new index pattern that is allowed to be accessed by all users.

Per the page [Defining Search Guard Roles](https://docs.search-guard.com/latest/roles-permissions), I should be able to do this using a Java regex. As a result, I wrote the following role:

```
# Grant read access on all indices except for those matching
# regex pattern.
readall_except:
  cluster:
  - "CLUSTER_COMPOSITE_OPS_RO"
  indices:
    /^(?!myapp-)\S*$/gm:
      '*':
      - "READ"

```

The regex for the index name should match anything, as long as it doesn’t start with `myapp-`. This regex appears to work correctly in a regex tester for the following index patterns (not matching the first, matching the second):

```
myapp-filebeat-6.7.1-2019.05.01
notmyapp-filebeat-6.7.1-2019.05.01

```

However, when I plug this into Search Guard to test, my test user is denied access to all indices.

---

<div class="post-metadata">

**Author:** ![cstaley](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/cstaley/32/463_2.png) [@cstaley](https://forum.search-guard.com/u/cstaley)\
**Post date:** [May 3, 2019, 6:19pm UTC](https://forum.search-guard.com/t/blacklist-indices/1469/2 "2019-05-03T18:19:54Z")

</div>

Assigned @cstaley on May 3, 2019, 6:19pm UTC



---

<div class="post-metadata">

**Author:** ![cstaley](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/cstaley/32/463_2.png) [@cstaley](https://forum.search-guard.com/u/cstaley)\
**Post date:** [May 3, 2019, 6:20pm UTC](https://forum.search-guard.com/t/blacklist-indices/1469/3 "2019-05-03T18:20:47Z")

</div>

can your try

```
# Grant read access on all indices except for those matching
# regex pattern.
readall_except:
  cluster:
  - "CLUSTER_COMPOSITE_OPS_RO"
  indices:
    '/(?!myapp-)\S*/':
      '*':
      - "READ"

```

---

<div class="post-metadata">

**Author:** ![Doug\_Renze](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/doug_renze/32/720_2.png) [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\
**Post date:** [May 3, 2019, 6:38pm UTC](https://forum.search-guard.com/t/blacklist-indices/1469/4 "2019-05-03T18:38:23Z")

</div>

That did the trick. However, won’t that still match `notmyapp-...`? Admittedly, we don’t currently have any applications with naming schemas that closely matched, but I like to proactively avoid issues.

---

<div class="post-metadata">

**Author:** ![Doug\_Renze](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/doug_renze/32/720_2.png) [@Doug\_Renze](https://forum.search-guard.com/u/Doug_Renze)\
**Post date:** [May 3, 2019, 7:21pm UTC](https://forum.search-guard.com/t/blacklist-indices/1469/5 "2019-05-03T19:21:38Z")

</div>

Modifying it to:

```
# Grant read access on all indices except for those matching
# regex pattern.
readall_except:
  cluster:
  - "CLUSTER_COMPOSITE_OPS_RO"
  indices:
    '/^(?!myapp-)\S*$/':
      '*':
      - "READ"

```

still works and avoids the issue of matching similar indices.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [May 24, 2019, 7:21pm UTC](https://forum.search-guard.com/t/blacklist-indices/1469/6 "2019-05-24T19:21:53Z")

</div>

Closed on May 24, 2019, 7:21pm UTC

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.