# I need Enterprice license?

**URL:** <https://forum.search-guard.com/t/i-need-enterprice-license/1078>\
**Category:** Search Guard\
**Created:** [August 20, 2018, 8:03am UTC](https://forum.search-guard.com/t/i-need-enterprice-license/1078 "2018-08-20T08:03:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel\_Glez](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@Daniel\_Glez](https://forum.search-guard.com/u/Daniel_Glez)\
**Post date:** [August 20, 2018, 8:03am UTC](https://forum.search-guard.com/t/i-need-enterprice-license/1078/1 "2018-08-20T08:03:16Z")

</div>

Hi Friends, I´m new with ELK and SG, for this I have a single question:

I need ELK users to access only their specific logs.

For example, as the image shows:

user who has that container id, can only read the logs of this container.

 ![jonh.jpg](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/855437cc58966ca75cf168cb872d8e93430c9c91.jpeg)

 ![sg.jpg](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/826e393c4f9ab8b3891cd6e1e0e59cc2856f6781.jpeg)

I understand that this is only possible with a paid version of search-guard. It is true?

Thanks !

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [August 21, 2018, 2:01am UTC](https://forum.search-guard.com/t/i-need-enterprice-license/1078/2 "2018-08-21T02:01:36Z")

</div>

To answer that question I’d need to have more insight into how your data is structured. In other words - it depends 😉

So if your logs are stored in one index, and you want to show only parts of the documents to a user based on the container id, then the answer is yes. You need to use Document-Level security for that. So say when a user authenticates and has a user attribute _container\_id_, you can use a dynamic DLS query that matches this user attribute with the _container.id_ field of your documents to filter out non-matching documents. This would require an Enterprise license.

If you have multiple indices, one per container id, and the index name contains the container id you can use the Community Edition and the dynamic index name/variable substitution feature to achieve this:

> **[Search Guard roles](https://docs.search-guard.com/latest/roles-permissions#dynamic-index-names-user-attributes)**
>
> How to define role based access to Elasticsearch on index level with Search Guard.

> **···**
>
> On Monday, August 20, 2018 at 3:03:17 AM UTC-5, Daniel Glez wrote:
> 
> > 
> 
> > Hi Friends, I´m new with ELK and SG, for this I have a single question:
> 
> > 
> 
> > 
> 
> > I need ELK users to access only their specific logs.
> 
> > For example, as the image shows:
> 
> > user who has that container id, can only read the logs of this container.
> 
> > 
> 
> > 
> 
> > ![jonh.jpg](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/855437cc58966ca75cf168cb872d8e93430c9c91.jpeg)
> 
> > 
> 
> > 
> 
> > ![sg.jpg](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/826e393c4f9ab8b3891cd6e1e0e59cc2856f6781.jpeg)
> 
> > 
> 
> > 
> 
> > 
> 
> > I understand that this is only possible with a paid version of search-guard. It is true?
> 
> > 
> 
> > Thanks !

---

<div class="post-metadata">

**Author:** ![Daniel\_Glez](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@Daniel\_Glez](https://forum.search-guard.com/u/Daniel_Glez)\
**Post date:** [August 21, 2018, 6:51am UTC](https://forum.search-guard.com/t/i-need-enterprice-license/1078/3 "2018-08-21T06:51:22Z")

</div>

Hi Jochen;

It is exactly what I needed to know.

As you say, I have an index and I want to show parts of the index.

I’m going to look at the multiple indices option.

thanks for helping!!

> **···**
>
> El martes, 21 de agosto de 2018, 4:01:36 (UTC+2), Jochen Kressin escribió:
> 
> > To answer that question I’d need to have more insight into how your data is structured. In other words - it depends 😉
> 
> > So if your logs are stored in one index, and you want to show only parts of the documents to a user based on the container id, then the answer is yes. You need to use Document-Level security for that. So say when a user authenticates and has a user attribute _container\_id_, you can use a dynamic DLS query that matches this user attribute with the _[container.id](http://container.id)_ field of your documents to filter out non-matching documents. This would require an Enterprise license.
> 
> > 
> 
> > If you have multiple indices, one per container id, and the index name contains the container id you can use the Community Edition and the dynamic index name/variable substitution feature to achieve this:
> 
> > 
> 
> > [https://docs.search-guard.com/latest/roles-permissions#dynamic-index-names-user-attributes](https://docs.search-guard.com/latest/roles-permissions#dynamic-index-names-user-attributes)
> 
> > 
> 
> > On Monday, August 20, 2018 at 3:03:17 AM UTC-5, Daniel Glez wrote:
> > 
> > >
> 
> > > Hi Friends, I´m new with ELK and SG, for this I have a single question:
> 
> > >
> 
> > >
> 
> > > I need ELK users to access only their specific logs.
> 
> > > For example, as the image shows:
> 
> > > user who has that container id, can only read the logs of this container.
> 
> > >
> 
> > >
> 
> > > ![jonh.jpg](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/855437cc58966ca75cf168cb872d8e93430c9c91.jpeg)
> 
> > >
> 
> > >
> 
> > > ![sg.jpg](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/826e393c4f9ab8b3891cd6e1e0e59cc2856f6781.jpeg)
> 
> > >
> 
> > >
> 
> > >
> 
> > > I understand that this is only possible with a paid version of search-guard. It is true?
> 
> > >
> 
> > > Thanks !