# Authentication and enforcing fields

**URL:** <https://discuss.elastic.co/t/authentication-and-enforcing-fields/187033>\
**Category:** Logstash\
**Created:** [June 24, 2019, 3:06am UTC](https://discuss.elastic.co/t/authentication-and-enforcing-fields/187033 "2019-06-24T03:06:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tracyreed](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tracyreed](https://discuss.elastic.co/u/tracyreed)\
**Post date:** [June 24, 2019, 3:06am UTC](https://discuss.elastic.co/t/authentication-and-enforcing-fields/187033/1 "2019-06-24T03:06:48Z")

</div>

Hello all!

Is there any way to tie certain fields to certain auth keys or any way to set a field if a client auths with a particular cert?

For example, I want to be able to receive data from multiple business units and I want to be able to say this in my filebeat config:

filebeat.prospectors:  
fields:  
bu: accounting

and not allow anyone with access to that machine be able to change it to anything else? I know I can't prevent someone with admin access to that machine changing it. So I'm just wondering how to best handle this. If they auth with accounting's key I want them to have bu: accounting or be able to track the logs from accounting in some other way. The problem I am trying to solve is that I index by business unit with index name keyed off of that field and I don't want one BU sticking their logs into the index for another. Ideas?

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 22, 2019, 3:07am UTC](https://discuss.elastic.co/t/authentication-and-enforcing-fields/187033/2 "2019-07-22T03:07:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.