# Action indices:data/read/mget is unauthorized but privilege listed
**URL:** https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [December 22, 2015, 4:39pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774 "2015-12-22T16:39:30Z")
**Posts on this page:** 12
**Page:** 2
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [January 4, 2016, 8:23pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/21 "2016-01-04T20:23:06Z")
Hmm, can you see if granting the user access to read the marvel indices `.marvel_es-*` resolves the issue? If a request contains indices that a user is not granted access to then the entire request will be denied.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [January 6, 2016, 3:14pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/22 "2016-01-06T15:14:10Z")
I did that and now I no longer see the access\_denied for the marvel index. Now I'm just getting:
```
[timestamp] [servername] [transport] [access_denied] origin_type=[rest], origin_address=#, principal=[cdfoote], action=[indices:data/read/msearch]
[timestamp] [servername] [transport] [access_denied] origin_type=[rest], origin_address=#, principal=[cdfoote], action=[indices:data/read/msearch]
[timestamp] [servername] [transport] [access_denied] origin_type=[rest], origin_address=#, principal=[cdfoote], action=[indices:data/read/msearch]
[timestamp] [servername] [transport] [access_denied] origin_type=[rest], origin_address=#, principal=[cdfoote], action=[indices:data/read/msearch], request=[MultiSearchRequest]
```
No indices listed.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [January 6, 2016, 8:25pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/23 "2016-01-06T20:25:46Z")
The elasticsearch log, as opposed to the access log, is showing what I believe is proper authentication:
```
[timestamp][DEBUG][shield.authc.support][servername][the roles[[cdfoote_role]], are mapped from the user [ldap] for realm [uid=cdfoote,.../ldap]
[timestamp][DEBUG][shield.authc.ldap][servername][authenticated user [cdfoote, with roles [[cdfoote_role]]
ElasticsearchSecurityException[action [indices:data/read/msearch] is unauthorized for user [cdfoote]]
```
Can someone confirm this for me please?
I still don't know why the authorization error occurrs, I've granted cdfoote\_role "indices:data/read/msearch".
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [January 7, 2016, 5:47pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/24 "2016-01-07T17:47:52Z")
The log does show the proper authentication and role mapping from what I can tell, for some reason there is something unauthorized about the request Kibana is making. Kibana supports logging everything with the `logging.verbose` property [https://www.elastic.co/guide/en/kibana/current/kibana-server-properties.html](https://www.elastic.co/guide/en/kibana/current/kibana-server-properties.html). With that we should be able to see the request and look at that to see why it is failing with your user.
---
### Author:  [@terje](https://discuss.elastic.co/u/terje)
#### Post date: [January 8, 2016, 7:21am UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/25 "2016-01-08T07:21:47Z")
Are you giving privileges to index aliases and use a wildcard index pattern in Kibana? After upgrading to Kibana 4.3.0, some of our users with privileges only on index aliases started to get "action [indices:data/read/msearch] is unauthorized for user ..." in Kibana.
See this issue on github: [https://github.com/elastic/kibana/issues/5715](https://github.com/elastic/kibana/issues/5715)
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [January 11, 2016, 6:36pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/26 "2016-01-11T18:36:19Z")
We are not using aliases.
We ended up granting search and msearch privileges on \* ☹
---
### Author:  [@sqpdln](https://discuss.elastic.co/u/sqpdln)
#### Post date: [April 29, 2016, 9:51am UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/27 "2016-04-29T09:51:43Z")
Having a similar issue. Logged in in Kibana with a user who has the privilege data/read/msearch, but getting the
error:
`Discover: [security_exception] action [indices:data/read/msearch] is unauthorized for user [my_user]`
But: the error only shows up when there's no data in the selected timespan in Kibana.
```auto
my_user:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'*end':
privileges:
- indices:admin/mappings/fields/get
- indices:admin/validate/query
- indices:data/read/search
- indices:data/read/msearch
- indices:data/read/field_stats
- indices:admin/get
'.kibana':
privileges:
- indices:admin/exists
- indices:admin/mapping/put
- indices:admin/mappings/fields/get
- indices:admin/refresh
- indices:admin/validate/query
- indices:data/read/get
- indices:data/read/mget
- indices:data/read/search
- indices:data/write/delete
- indices:data/write/index
- indices:data/write/update
```
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 29, 2016, 10:44am UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/28 "2016-04-29T10:44:04Z")
I think you need to change `.kibana` to `.kibana*` as Kibana now tries to search an additional index.
---
### Author:  [@sqpdln](https://discuss.elastic.co/u/sqpdln)
#### Post date: [April 29, 2016, 12:50pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/29 "2016-04-29T12:50:54Z")
but .kibana is the name of the index? this is copied from the default kibana4 role.
anyway, didn't work.
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [April 29, 2016, 2:38pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/30 "2016-04-29T14:38:04Z")
Kibana searches an additional index, see [https://github.com/elastic/kibana/issues/6302](https://github.com/elastic/kibana/issues/6302)
It looks like `indices:data/read/msearch` is missing from the .kibana portion. Can you try adding the privilege and changing to `.kibana*`?
We've tried to simplify the way permissions are done, you can also use the role in the latest docs: [https://www.elastic.co/guide/en/shield/current/kibana.html](https://www.elastic.co/guide/en/shield/current/kibana.html) (see my\_kibana\_user)
---
### Author:  [@sqpdln](https://discuss.elastic.co/u/sqpdln)
#### Post date: [April 29, 2016, 3:31pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/31 "2016-04-29T15:31:46Z")
great, now i see. i missed trying to add both things at the same time. thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:44pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/32 "2017-07-06T13:44:57Z")
[Previous page](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774.md?page=1)