Cannot access _source data with new user

ID: 5a043a


Just migrating from local ELK cluster to elastic cloud.

When I search with our root user 'elastic', I can see results of a simple index search. The _source field of each result is populated as expected.

When I repeat the search with a new user, I get the right number of results but the _source field is {}.

The user has a custom role 'all' which gives:

Full cluster privileges
Run as privileges: *
Indices privileges: *, all

Does this not give full access?


Hi @Simon_Pickles

I'm going to move this to X-pack since I think you'll get a better response there - I think this is a question over roles and not something that's specific to Cloud (and I'm sure that one of the engineers over there will ping pong it back again if I'm wrong!)


This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.