#elasticsearch.yml 添加
#################search-guard###################
searchguard.enabled: true
searchguard.key_path: /home/work/app/elasticsearch/keys
searchguard.auditlog.enabled: true
searchguard.allow_all_from_loopback: true #本地调试可打开，建议在线上关闭
searchguard.check_for_root: false
searchguard.http.enable_sessions: true
#配置认证方式
searchguard.authentication.authentication_backend.impl: com.floragunn.searchguard.authentication.backend.simple.SettingsBasedAuthenticationBackend
searchguard.authentication.authorizer.impl: com.floragunn.searchguard.authorization.simple.SettingsBasedAuthorizator
searchguard.authentication.http_authenticator.impl: com.floragunn.searchguard.authentication.http.basic.HTTPBasicAuthenticator
#配置用户名和密码
searchguard.authentication.settingsdb.user.admin: admin
searchguard.authentication.settingsdb.user.user1: 123
searchguard.authentication.settingsdb.user.user2: 123
#配置用户角色
searchguard.authentication.authorization.settingsdb.roles.admin: [“root”]
searchguard.authentication.authorization.settingsdb.roles.user1: [“user1”]
searchguard.authentication.authorization.settingsdb.roles.user2: [“user2”]
#配置角色权限（只读）
searchguard.actionrequestfilter.names: [“readonly”,“deny”]
searchguard.actionrequestfilter.readonly.allowed_actions: [“indices:data/read/", “indices:admin/exists”,"indices:admin/mappings/”,“indices:admin/validate/query”]
searchguard.actionrequestfilter.readonly.forbidden_actions: [“indices:data/write/*”]
#配置角色权限（禁止访问）
searchguard.actionrequestfilter.deny.allowed_actions:
searchguard.actionrequestfilter.deny.forbidden_actions: [“indices:data/write/*”]
curl -XPUT ‘http://localhost:9200/searchguard/ac/ac?pretty’ -d ’
{“acl”: [
{
“Comment”: “Default is to execute all filters”,
“filters_bypass”: ,
“filters_execute”: [“actionrequestfilter.deny”]
}, //默认禁止访问
{
“Comment”: “This means that every requestor (regardless of the requestors hostname and username) which has the root role can do anything”,
“roles”: [
“root”
],
“filters_bypass”: [“*”],
“filters_execute”:
}, // root角色完全权限
{
“Comment”: “This means that for the user spock on index popstuff only the actionrequestfilter.readonly will be executed, no other”,
“users”: [“user1”],
“indices”: [“index1-","index2-”,“.kibana”],
“filters_bypass”: [“actionrequestfilter.deny”],
“filters_execute”: [“actionrequestfilter.readonly”]
}, //user1 用户只能访问index1-,index2- 索引，且只有只读权限
{
“Comment”: “This means that for the user spock on index popstuff only the actionrequestfilter.readonly will be executed, no other”,
“users”: [“user2”],
“indices”: [“index3-*”,“.kibana”],
“filters_bypass”: [“actionrequestfilter.deny”],
“filters_execute”: [“actionrequestfilter.readonly”]
} //user2 用户只能访问index3-* 索引，且只有只读权限
]}}
Please check in detail：