[2019-03-11T14:14:21,890][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:21,890][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? false (cache size: 4)
[2019-03-11T14:14:21,890][DEBUG][c.f.s.a.BackendRegistry  ] giedre not cached, return from internal backend directly
[2019-03-11T14:14:22,213][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:22,261][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:22,261][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:22,439][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:22,439][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:22,439][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:22,439][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:22,490][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:22,490][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:22,490][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:22,490][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:22,499][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:22,499][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:22,499][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:22,499][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=giedre, roles=[rr_subscription_report]]
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] requested indices:data/read/get from 172.20.0.3:55516
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.GetRequest
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore_unavailable=false, allow_no_indices=false, expand_wildcards_open=false, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=false, forbid_closed_indices=true]
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] raw indices [.kibana]
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolved [.kibana] to [.kibana]
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=.kibana, type=config]]
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for giedre: [rr_subscription_report]
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: rr_subscription_report
[2019-03-11T14:14:22,500][DEBUG][c.f.s.c.PrivilegesEvaluator] Added to leftovers rr_subscription_report=>[IndexType [index=.kibana, type=config]]
[2019-03-11T14:14:22,500][INFO ][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=giedre, roles=[rr_subscription_report]] [IndexType [index=.kibana, type=config]] [Action [indices:data/read/get]] [RolesChecked [rr_subscription_report]]
[2019-03-11T14:14:22,500][INFO ][c.f.s.c.PrivilegesEvaluator] No permissions for {rr_subscription_report=[IndexType [index=.kibana, type=config]]}
[2019-03-11T14:14:22,500][DEBUG][c.f.s.f.SearchGuardFilter] no permissions for indices:data/read/get
[2019-03-11T14:14:23,807][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:23,808][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:23,808][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:23,808][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:23,984][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:23,984][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:23,984][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:23,984][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:23,991][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:23,991][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:23,991][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:23,991][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=giedre, roles=[rr_subscription_report]]
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] requested indices:data/read/search from 172.20.0.3:55518
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.search.SearchRequest
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] indicesOptions IndicesOptions[id=38, ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=true, forbid_closed_indices=true]
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] raw indices [.kibana]
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolved [.kibana] to [.kibana]
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=.kibana, type=index-pattern]]
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for giedre: [rr_subscription_report]
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: rr_subscription_report
[2019-03-11T14:14:23,991][DEBUG][c.f.s.c.PrivilegesEvaluator] Added to leftovers rr_subscription_report=>[IndexType [index=.kibana, type=index-pattern]]
[2019-03-11T14:14:23,991][INFO ][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=giedre, roles=[rr_subscription_report]] [IndexType [index=.kibana, type=index-pattern]] [Action [indices:data/read/search]] [RolesChecked [rr_subscription_report]]
[2019-03-11T14:14:23,991][INFO ][c.f.s.c.PrivilegesEvaluator] No permissions for {rr_subscription_report=[IndexType [index=.kibana, type=index-pattern]]}
[2019-03-11T14:14:23,991][DEBUG][c.f.s.f.SearchGuardFilter] no permissions for indices:data/read/search
[2019-03-11T14:14:38,710][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:38,710][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:38,710][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:38,710][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:38,718][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:38,718][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:38,718][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:38,718][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:38,718][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=giedre, roles=[rr_subscription_report]]
[2019-03-11T14:14:38,718][DEBUG][c.f.s.c.PrivilegesEvaluator] requested indices:data/read/get from 172.20.0.3:55530
[2019-03-11T14:14:38,718][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.GetRequest
[2019-03-11T14:14:38,718][DEBUG][c.f.s.c.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore_unavailable=false, allow_no_indices=false, expand_wildcards_open=false, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=false, forbid_closed_indices=true]
[2019-03-11T14:14:38,718][DEBUG][c.f.s.c.PrivilegesEvaluator] raw indices [.kibana]
[2019-03-11T14:14:38,718][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolved [.kibana] to [.kibana]
[2019-03-11T14:14:38,718][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=.kibana, type=config]]
[2019-03-11T14:14:38,719][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for giedre: [rr_subscription_report]
[2019-03-11T14:14:38,719][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: rr_subscription_report
[2019-03-11T14:14:38,719][DEBUG][c.f.s.c.PrivilegesEvaluator] Added to leftovers rr_subscription_report=>[IndexType [index=.kibana, type=config]]
[2019-03-11T14:14:38,719][INFO ][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=giedre, roles=[rr_subscription_report]] [IndexType [index=.kibana, type=config]] [Action [indices:data/read/get]] [RolesChecked [rr_subscription_report]]
[2019-03-11T14:14:38,719][INFO ][c.f.s.c.PrivilegesEvaluator] No permissions for {rr_subscription_report=[IndexType [index=.kibana, type=config]]}
[2019-03-11T14:14:38,719][DEBUG][c.f.s.f.SearchGuardFilter] no permissions for indices:data/read/get
[2019-03-11T14:14:39,811][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:39,811][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:39,811][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:39,811][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:39,880][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:39,880][DEBUG][c.f.s.a.BackendRegistry  ] User 'kibanaserver' is in cache? true (cache size: 5)
[2019-03-11T14:14:39,880][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=kibanaserver, roles=[]]' is authenticated
[2019-03-11T14:14:39,880][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:40,007][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:40,007][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:40,007][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:40,007][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:40,010][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:14:40,010][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:14:40,010][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:14:40,010][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:14:40,010][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=giedre, roles=[rr_subscription_report]]
[2019-03-11T14:14:40,010][DEBUG][c.f.s.c.PrivilegesEvaluator] requested indices:data/read/search from 172.20.0.3:55532
[2019-03-11T14:14:40,010][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.search.SearchRequest
[2019-03-11T14:14:40,010][DEBUG][c.f.s.c.PrivilegesEvaluator] indicesOptions IndicesOptions[id=38, ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=true, forbid_closed_indices=true]
[2019-03-11T14:14:40,010][DEBUG][c.f.s.c.PrivilegesEvaluator] raw indices [.kibana]
[2019-03-11T14:14:40,010][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolved [.kibana] to [.kibana]
[2019-03-11T14:14:40,010][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=.kibana, type=index-pattern]]
[2019-03-11T14:14:40,011][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for giedre: [rr_subscription_report]
[2019-03-11T14:14:40,011][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: rr_subscription_report
[2019-03-11T14:14:40,011][DEBUG][c.f.s.c.PrivilegesEvaluator] Added to leftovers rr_subscription_report=>[IndexType [index=.kibana, type=index-pattern]]
[2019-03-11T14:14:40,011][INFO ][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=giedre, roles=[rr_subscription_report]] [IndexType [index=.kibana, type=index-pattern]] [Action [indices:data/read/search]] [RolesChecked [rr_subscription_report]]
[2019-03-11T14:14:40,011][INFO ][c.f.s.c.PrivilegesEvaluator] No permissions for {rr_subscription_report=[IndexType [index=.kibana, type=index-pattern]]}
[2019-03-11T14:14:40,011][DEBUG][c.f.s.f.SearchGuardFilter] no permissions for indices:data/read/search
[2019-03-11T14:17:35,432][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:35,432][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:17:35,432][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:17:35,432][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:35,468][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:35,468][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:17:35,468][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:17:35,468][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:35,473][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:35,473][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:17:35,473][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:17:35,473][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=giedre, roles=[rr_subscription_report]]
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] requested indices:data/read/get from 172.20.0.3:55626
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.get.GetRequest
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] indicesOptions IndicesOptions[id=48, ignore_unavailable=false, allow_no_indices=false, expand_wildcards_open=false, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=false, forbid_closed_indices=true]
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] raw indices [.kibana]
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolved [.kibana] to [.kibana]
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=.kibana, type=config]]
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for giedre: [rr_subscription_report]
[2019-03-11T14:17:35,473][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: rr_subscription_report
[2019-03-11T14:17:35,474][DEBUG][c.f.s.c.PrivilegesEvaluator] Added to leftovers rr_subscription_report=>[IndexType [index=.kibana, type=config]]
[2019-03-11T14:17:35,474][INFO ][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=giedre, roles=[rr_subscription_report]] [IndexType [index=.kibana, type=config]] [Action [indices:data/read/get]] [RolesChecked [rr_subscription_report]]
[2019-03-11T14:17:35,474][INFO ][c.f.s.c.PrivilegesEvaluator] No permissions for {rr_subscription_report=[IndexType [index=.kibana, type=config]]}
[2019-03-11T14:17:37,064][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:37,064][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:17:37,064][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:17:37,064][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:38,549][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:38,549][DEBUG][c.f.s.a.BackendRegistry  ] User 'kibanaserver' is in cache? true (cache size: 5)
[2019-03-11T14:17:38,549][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=kibanaserver, roles=[]]' is authenticated
[2019-03-11T14:17:38,549][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:38,549][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=kibanaserver, roles=[]]
[2019-03-11T14:17:38,549][DEBUG][c.f.s.c.PrivilegesEvaluator] requested cluster:monitor/main from 172.20.0.3:57012
[2019-03-11T14:17:38,549][DEBUG][c.f.s.c.PrivilegesEvaluator] class org.elasticsearch.action.main.MainRequest is not an IndicesRequest
[2019-03-11T14:17:38,549][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=_all, type=*]]
[2019-03-11T14:17:38,549][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for kibanaserver: [sg_kibana_server]
[2019-03-11T14:17:38,550][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: sg_kibana_server
[2019-03-11T14:17:38,550][DEBUG][c.f.s.c.PrivilegesEvaluator]   resolved cluster actions:[indices:admin/aliases/exists*, indices:data/read/msearch, indices:admin/aliases*, indices:data/read/coordinate-msearch*, indices:data/write/bulk, indices:admin/aliases/get*, indices:data/read/mget, indices:data/read/mtv, cluster:monitor/*]
[2019-03-11T14:17:38,550][DEBUG][c.f.s.c.PrivilegesEvaluator]   found a match for 'sg_kibana_server' and cluster:monitor/main, skip other roles
[2019-03-11T14:17:38,550][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:38,550][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:17:38,550][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:17:38,550][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:38,551][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:38,551][DEBUG][c.f.s.a.BackendRegistry  ] User 'kibanaserver' is in cache? true (cache size: 5)
[2019-03-11T14:17:38,551][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=kibanaserver, roles=[]]' is authenticated
[2019-03-11T14:17:38,551][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:38,551][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=kibanaserver, roles=[]]
[2019-03-11T14:17:38,551][DEBUG][c.f.s.c.PrivilegesEvaluator] requested cluster:monitor/nodes/info from 172.20.0.3:57014
[2019-03-11T14:17:38,551][DEBUG][c.f.s.c.PrivilegesEvaluator] class org.elasticsearch.action.admin.cluster.node.info.NodesInfoRequest is not an IndicesRequest
[2019-03-11T14:17:38,551][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=_all, type=*]]
[2019-03-11T14:17:38,551][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for kibanaserver: [sg_kibana_server]
[2019-03-11T14:17:38,551][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: sg_kibana_server
[2019-03-11T14:17:38,551][DEBUG][c.f.s.c.PrivilegesEvaluator]   resolved cluster actions:[indices:admin/aliases/exists*, indices:data/read/msearch, indices:admin/aliases*, indices:data/read/coordinate-msearch*, indices:data/write/bulk, indices:admin/aliases/get*, indices:data/read/mget, indices:data/read/mtv, cluster:monitor/*]
[2019-03-11T14:17:38,551][DEBUG][c.f.s.c.PrivilegesEvaluator]   found a match for 'sg_kibana_server' and cluster:monitor/nodes/info, skip other roles
[2019-03-11T14:17:38,554][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:38,554][DEBUG][c.f.s.a.BackendRegistry  ] User 'kibanaserver' is in cache? true (cache size: 5)
[2019-03-11T14:17:38,554][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=kibanaserver, roles=[]]' is authenticated
[2019-03-11T14:17:38,554][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=kibanaserver, roles=[]]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] requested cluster:monitor/nodes/info from 172.20.0.3:57012
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] class org.elasticsearch.action.admin.cluster.node.info.NodesInfoRequest is not an IndicesRequest
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=_all, type=*]]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for kibanaserver: [sg_kibana_server]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: sg_kibana_server
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator]   resolved cluster actions:[indices:admin/aliases/exists*, indices:data/read/msearch, indices:admin/aliases*, indices:data/read/coordinate-msearch*, indices:data/write/bulk, indices:admin/aliases/get*, indices:data/read/mget, indices:data/read/mtv, cluster:monitor/*]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.a.BackendRegistry  ] Try to extract auth creds from http basic
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator]   found a match for 'sg_kibana_server' and cluster:monitor/nodes/info, skip other roles
[2019-03-11T14:17:38,554][DEBUG][c.f.s.a.BackendRegistry  ] User 'giedre' is in cache? true (cache size: 5)
[2019-03-11T14:17:38,554][DEBUG][c.f.s.a.BackendRegistry  ] User 'User [name=giedre, roles=[rr_subscription_report]]' is authenticated
[2019-03-11T14:17:38,554][DEBUG][c.f.s.a.BackendRegistry  ] sg_tenant 'null'
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=giedre, roles=[rr_subscription_report]]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] requested indices:data/read/search from 172.20.0.3:55628
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.search.SearchRequest
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] indicesOptions IndicesOptions[id=38, ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, allow_alisases_to_multiple_indices=true, forbid_closed_indices=true]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] raw indices [.kibana]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] Resolved [.kibana] to [.kibana]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=.kibana, type=index-pattern]]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for giedre: [rr_subscription_report]
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg_role: rr_subscription_report
[2019-03-11T14:17:38,554][DEBUG][c.f.s.c.PrivilegesEvaluator] Added to leftovers rr_subscription_report=>[IndexType [index=.kibana, type=index-pattern]]
[2019-03-11T14:17:38,554][INFO ][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=giedre, roles=[rr_subscription_report]] [IndexType [index=.kibana, type=index-pattern]] [Action [indices:data/read/search]] [RolesChecked [rr_subscription_report]]
[2019-03-11T14:17:38,554][INFO ][c.f.s.c.PrivilegesEvaluator] No permissions for {rr_subscription_report=[IndexType [index=.kibana, type=index-pattern]]}
[2019-03-11T14:17:38,555][DEBUG][c.f.s.f.SearchGuardFilter] no permissions for indices:data/read/search