User unable to view streaming logs in Kibana

Search Guard
1

TL;DR

Member of SGS_KIBANA_USER and SGS_READALL unable to view Logs under Observability section in Kibana.

Implementation Details

  • Elasticsearch/Kibana: 7.8.0
  • Search Guard (ES & Kibana): 43.0.0

Issues

I have a user with SGS_KIBANA_USER and SGS_READALL roles who is attempting to view streaming logs under the Observability->Logs in Kibana. She has access to the indices she’s attempting to view and can view them in Discover, but cannot view any logs in the streaming view.

I can view the streaming logs using the same configuration she’s attempting to use. But then, I have SGS_ALL_ACCESS, so I would expect to be able to.

I assume this is a permissions issue. What permissions do I need to grant in order to allow her to use this feature, short of granting admin permissions?

2

I assume this is a permissions issue. What permissions do I need to grant in order to allow her to use this feature, short of granting admin permissions?

If there is a permission issue, you should see the related error in the Elasticsearch log. Do you see any errors there?

3

I haven’t been able to connect with the user yet and will post logs as soon as I’m able to.