# Negating a set of indices via java regex in the sg\_roles **URL:** \ **Category:** Search Guard\ **Created:** [November 27, 2017, 11:14am UTC](https://forum.search-guard.com/t/negating-a-set-of-indices-via-java-regex-in-the-sg-roles/692 "2017-11-27T11:14:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Christian\_Moreno\_Moreno](https://avatars.discourse-cdn.com/v4/letter/c/6f9a4e/32.png) [@Christian\_Moreno\_Moreno](https://forum.search-guard.com/u/Christian_Moreno_Moreno)\ **Post date:** [November 27, 2017, 11:14am UTC](https://forum.search-guard.com/t/negating-a-set-of-indices-via-java-regex-in-the-sg-roles/692/1 "2017-11-27T11:14:21Z")
Hi all, is possible negating a set of indices via java regex in the sg\_roles? We tried to do something like: sg\_all\_access: cluster: - UNLIMITED indices: ‘`/\``!seo-`_/': '_’: - UNLIMITED tenants: adm\_tenant: RW test\_tenant\_ro: RW So, every index is permit only “seo-\*” not. We tried with some differents systax but any of them run… is not permit negating a couple set of words? Many Thanks, Christian Moreno - Search Guard version: 5.5.0 - Elasticsearch version: 5.5.0-16 - Java Version: java version “1.8.0\_144” - Until now only Free licence ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [November 27, 2017, 5:25pm UTC](https://forum.search-guard.com/t/negating-a-set-of-indices-via-java-regex-in-the-sg-roles/692/2 "2017-11-27T17:25:02Z")
you can use whatever java regex supports: [Pattern (Java Platform SE 7 )](https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html) Try '/(?!seo-.\*$).\*/' (no guarantees) > **···** > > > Am 27.11.2017 um 12:14 schrieb Christian Moreno Moreno \: > > > > Hi all, > > > > is possible negating a set of indices via java regex in the sg\_roles? > > We tried to do something like: > > > > sg\_all\_access: > >   cluster: > >     - UNLIMITED > >   indices: > >     '/\!seo-\*/': > >       '\*': > >         - UNLIMITED > >   tenants: > >     adm\_tenant: RW > >     test\_tenant\_ro: RW > > > > So, every index is permit only "seo-\*" not. We tried with some differents systax but any of them run... is not permit negating a couple set of words? > > > > Many Thanks, > > Christian Moreno > > > > \* Search Guard version: 5.5.0 > > \* Elasticsearch version: 5.5.0-16 > > \* Java Version: java version "1.8.0\_144" > > \* Until now only Free licence > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/a1fec70f-39d6-4147-b396-5125b29de172%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/a1fec70f-39d6-4147-b396-5125b29de172%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Chris\_Cogdon](https://avatars.discourse-cdn.com/v4/letter/c/5e9695/32.png) [@Chris\_Cogdon](https://forum.search-guard.com/u/Chris_Cogdon)\ **Post date:** [November 29, 2017, 10:25pm UTC](https://forum.search-guard.com/t/negating-a-set-of-indices-via-java-regex-in-the-sg-roles/692/3 "2017-11-29T22:25:17Z")
> you can use whatever java regex supports: [https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html](https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html) > > Try ‘/(?!seo-._$)._/’ (no guarantees) I’m having this issue today, too! I have this: indices: ``` '/^(?!endpoints$|thing1$|thing2$|thing3$).*/': '*': - ALL ``` `` And there was no match. Debugging says: [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_most\_access [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] Try wildcard match for \* [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] Wildcard match for \*: [endpoints-123] [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] matches for _, will check now types [_] [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] For index \* remaining requested indextype: [IndexType [index=endpoints-123, type=\*]] [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] Try wildcard match for /^(?!endpoints$|thing1$|thing2$|thing3$) [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] No wildcard match found for /^(?!endpoints$|thing1$|thing2$|thing3$) [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] For index /^(?!endpoints$|thing1$|thing2$|thing3$) remaining requested indextype: [IndexType [index=endpoints-123, type=\*]] [2017-11-29T17:15:24,801][DEBUG][c.f.s.c.PrivilegesEvaluator] Added to leftovers sg\_most\_access=\>[IndexType [index=endpoints-123, type=\*]] `` I’ve tried the regex through a [java regex tester](https://www.freeformatter.com/java-regex-tester.html) and it had a match. It’s as if it’s not treating it as a regex. Also odd that the trailing / in the debug output got dropped. > **···** > > On Monday, November 27, 2017 at 9:25:05 AM UTC-8, Search Guard wrote: > > > ---
**Author:** ![Chris\_Cogdon](https://avatars.discourse-cdn.com/v4/letter/c/5e9695/32.png) [@Chris\_Cogdon](https://forum.search-guard.com/u/Chris_Cogdon)\ **Post date:** [November 30, 2017, 12:05am UTC](https://forum.search-guard.com/t/negating-a-set-of-indices-via-java-regex-in-the-sg-roles/692/4 "2017-11-30T00:05:07Z")
NEVERMIND! I didn’t realise the “don’t put a dot in the index” actually refers to not having a dot anywhere in the _ **key** _, since ES will expand that into subkeys. Once I turned .\* into (?:\s|\S)\* , it worked a treat. Oh, I realise now that the “^” is unnecessary, since the code will surround the given pattern with “^” and “$” for you, enforcing a “whole string match”.