# regex support in roles definition

**URL:** <https://forum.search-guard.com/t/regex-support-in-roles-definition/812>\
**Category:** Search Guard\
**Created:** [February 20, 2018, 11:11am UTC](https://forum.search-guard.com/t/regex-support-in-roles-definition/812 "2018-02-20T11:11:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alextxm79](https://avatars.discourse-cdn.com/v4/letter/a/49beb7/32.png) [@alextxm79](https://forum.search-guard.com/u/alextxm79)\
**Post date:** [February 20, 2018, 11:11am UTC](https://forum.search-guard.com/t/regex-support-in-roles-definition/812/1 "2018-02-20T11:11:27Z")

</div>

Hi all,  
I’m trying to specify an index pattern in sg\_roles.yml but i can’t get it to work.

I’m using searchguard 5 (latest) with ES 5.6.6.

I’m using something like ‘/^myprefix.\*$/’ (to match myprefixWHATEVER indices) but it does not work:

sg\_testrole:

cluster:

- CLUSTER\_COMPOSITE\_OPS\_RO

- indices:data/read/scroll\*

indices:

#this WORKS but it not a regex

‘myprefix\*’:

‘\*’:

- READ

- SEARCH

- indices:data/read/field\_caps

#this DOES NOT work

‘/^myotherprefix.\*$/’:

‘\*’:

- READ

- SEARCH

- indices:data/read/field\_caps

‘?kibana’:

‘\*’:

- INDICES\_ALL

is there something wrong in my definition ?  
Thank you in advance for your help

Alessandro

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [February 21, 2018, 8:51pm UTC](https://forum.search-guard.com/t/regex-support-in-roles-definition/812/2 "2018-02-21T20:51:06Z")

</div>

try something '/myprefix.\*/' (omit the ^ $)

and '/myotherprefix.\*/'

> **···**
>
> > Am 20.02.2018 um 12:06 schrieb alextxm79@gmail.com:
> > 
> > Hi all,  
> > I'm trying to specify an index pattern in sg\_roles.yml but i can't get it to work.  
> > I'm using searchguard 5 (latest) with ES 5.6.6.
> > 
> > I'm using something like '/^myprefix.\*$/' (to match myprefixWHATEVER indices) but it does not work:
> > 
> > sg\_testrole:  
> > &nbsp;&nbsp;cluster:  
> > &nbsp;&nbsp;&nbsp;&nbsp;- CLUSTER\_COMPOSITE\_OPS\_RO  
> > &nbsp;&nbsp;&nbsp;&nbsp;- indices:data/read/scroll\*  
> > &nbsp;&nbsp;indices:  
> > &nbsp;&nbsp;&nbsp;&nbsp;#this WORKS but it not a regex  
> > &nbsp;&nbsp;&nbsp;&nbsp;'myprefix\*':  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\*':  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- READ  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- SEARCH  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- indices:data/read/field\_caps  
> > &nbsp;&nbsp;&nbsp;&nbsp;#this DOES NOT work  
> > &nbsp;&nbsp;&nbsp;&nbsp;'^myotherprefix.\*$':  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\*':  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- READ  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- SEARCH  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- indices:data/read/field\_caps  
> > &nbsp;&nbsp;&nbsp;&nbsp;'?kibana':  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\*':  
> > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- INDICES\_ALL
> > 
> > is there something wrong in my definition ?  
> > Thank you in advance for your help
> > 
> > Alessandro
> > 
> > --  
> > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group.  
> > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.  
> > To post to this group, send email to search-guard@googlegroups.com.  
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/d37be770-0c26-4da1-af35-0487007127b2%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/d37be770-0c26-4da1-af35-0487007127b2%40googlegroups.com%5C).  
> > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [February 21, 2018, 9:00pm UTC](https://forum.search-guard.com/t/regex-support-in-roles-definition/812/3 "2018-02-21T21:00:26Z")

</div>

ah, and you need to esacpe the dot (.) like explained here

[https://github.com/floragunncom/search-guard/blob/master/sgconfig/sg\_roles.yml](https://github.com/floragunncom/search-guard/blob/master/sgconfig/sg_roles.yml)  
and

> **[Search Guard roles](https://docs.search-guard.com/latest/roles-permissions#dynamic-index-names-wildcards-and-regular-expressions)**
>
> How to define role based access to Elasticsearch on index level with Search Guard.

> **···**
>
> > Am 21.02.2018 um 21:51 schrieb SG \<info@search-guard.com\>:
> > 
> > try something '/myprefix.\*/' (omit the ^ $)
> > 
> > and '/myotherprefix.\*/'
> > 
> > > Am 20.02.2018 um 12:06 schrieb alextxm79@gmail.com:
> > > 
> > > Hi all,  
> > > I'm trying to specify an index pattern in sg\_roles.yml but i can't get it to work.  
> > > I'm using searchguard 5 (latest) with ES 5.6.6.
> > > 
> > > I'm using something like '/^myprefix.\*$/' (to match myprefixWHATEVER indices) but it does not work:
> > > 
> > > sg\_testrole:  
> > > cluster:  
> > > &nbsp;&nbsp;&nbsp;- CLUSTER\_COMPOSITE\_OPS\_RO  
> > > &nbsp;&nbsp;&nbsp;- indices:data/read/scroll\*  
> > > indices:  
> > > &nbsp;&nbsp;&nbsp;#this WORKS but it not a regex  
> > > &nbsp;&nbsp;&nbsp;'myprefix\*':  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\*':  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- READ  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- SEARCH  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- indices:data/read/field\_caps  
> > > &nbsp;&nbsp;&nbsp;#this DOES NOT work  
> > > &nbsp;&nbsp;&nbsp;'^myotherprefix.\*$':  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\*':  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- READ  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- SEARCH  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- indices:data/read/field\_caps  
> > > &nbsp;&nbsp;&nbsp;'?kibana':  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'\*':  
> > > &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- INDICES\_ALL
> > > 
> > > is there something wrong in my definition ?  
> > > Thank you in advance for your help
> > > 
> > > Alessandro
> > > 
> > > --  
> > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group.  
> > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.  
> > > To post to this group, send email to search-guard@googlegroups.com.  
> > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/d37be770-0c26-4da1-af35-0487007127b2%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/d37be770-0c26-4da1-af35-0487007127b2%40googlegroups.com%5C).  
> > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).
