# Cannot see non-reserved users and roles since 6.1 upgrade

**URL:** <https://discuss.elastic.co/t/cannot-see-non-reserved-users-and-roles-since-6-1-upgrade/117970>\
**Category:** Elasticsearch\
**Created:** [February 1, 2018, 8:45am UTC](https://discuss.elastic.co/t/cannot-see-non-reserved-users-and-roles-since-6-1-upgrade/117970 "2018-02-01T08:45:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![stemps](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stemps/32/27242_2.png) [@stemps](https://discuss.elastic.co/u/stemps)\
**Post date:** [February 1, 2018, 8:45am UTC](https://discuss.elastic.co/t/cannot-see-non-reserved-users-and-roles-since-6-1-upgrade/117970/1 "2018-02-01T08:45:36Z")

</div>

We upgraded from 5.x to 6.1 and since then I cannot see any of the manually created users and roles anymore under Management -\> Users / Roles. I cannot see them on the dev console using the `GET /_xpack/security/user` endpoint either, but I can see them when accessing a user directly using the `GET /_xpack/security/user/<username>` endpoint. These "invisible" user can log in just fine.

I assumed an updated permission and gave my own user the `superuser` role and now I can see my own user in the list, but not the others.

It almost seems like v6.1 has introduced additional data structures for users that were not created properly during the migration but are created when I "touch" a user ?!?

Appreciate your help!

Simon

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 1, 2018, 9:14am UTC](https://discuss.elastic.co/t/cannot-see-non-reserved-users-and-roles-since-6-1-upgrade/117970/2 "2018-02-01T09:14:13Z")

</div>

Do you have an active support subscription?  
If so, it might be easier to resolve this through the support process, as it will allow us to dig into security details that you probably don't want to provide in public.

If not, let's see what we can debug here:

Firstly, did you run the migration assistant before upgrading?  
It make some changes to the security indices that are needed for 6.1 to work correctly.

Can you run each of the following and provide the results. None of the output should contain anything sensitive, but please double check before you post your results.

(You can replace `-u elastic` with another superuser if you want, but it needs to be a superuser)

```auto
curl -u elastic 'http://localhost:9200/.security?pretty' 

```

```auto
curl -u elastic 'http://localhost:9200/.security/user/_count?pretty'

```

```auto
curl -u elastic 'http://localhost:9200/.security/doc/_count?pretty'

```

```auto
curl -XGET -u elastic 'http://localhost:9200/.security/doc/_count?pretty' -d '{ "query": { "term": { "type": "user" } } }' -H "Content-Type: application/json"

```

---

<div class="post-metadata">

**Author:** ![stemps](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stemps/32/27242_2.png) [@stemps](https://discuss.elastic.co/u/stemps)\
**Post date:** [February 1, 2018, 10:36am UTC](https://discuss.elastic.co/t/cannot-see-non-reserved-users-and-roles-since-6-1-upgrade/117970/3 "2018-02-01T10:36:32Z")

</div>

Thanks a lot for the swift reply. Unfortunately we're on the "forum only" startup plan.

Here are the results:

```auto
/.security?pretty

```

> **Response**
>
> ```auto
> {
> ".security-6": {
> "aliases": {
> ".security": {}
> },
> "mappings": {
> "doc": {
> "dynamic": "strict",
> "_meta": {
> "security-version": "6.1.2"
> },
> "properties": {
> "cluster": {
> "type": "keyword"
> },
> "doc_type": {
> "type": "keyword"
> },
> "email": {
> "type": "text",
> "analyzer": "email"
> },
> "enabled": {
> "type": "boolean"
> },
> "expiration_time": {
> "type": "date",
> "format": "epoch_millis"
> },
> "full_name": {
> "type": "text"
> },
> "indices": {
> "properties": {
> "field_security": {
> "properties": {
> "except": {
> "type": "keyword"
> },
> "grant": {
> "type": "keyword"
> }
> }
> },
> "names": {
> "type": "keyword"
> },
> "privileges": {
> "type": "keyword"
> },
> "query": {
> "type": "keyword"
> }
> }
> },
> "metadata": {
> "type": "object",
> "dynamic": "true"
> },
> "name": {
> "type": "keyword"
> },
> "password": {
> "type": "keyword",
> "index": false,
> "doc_values": false
> },
> "roles": {
> "type": "keyword"
> },
> "rules": {
> "type": "object",
> "dynamic": "true"
> },
> "run_as": {
> "type": "keyword"
> },
> "type": {
> "type": "keyword"
> },
> "username": {
> "type": "keyword"
> }
> }
> }
> },
> "settings": {
> "index": {
> "number_of_shards": "1",
> "auto_expand_replicas": "0-all",
> "provided_name": ".security-6",
> "format": "6",
> "creation_date": "1516910549388",
> "analysis": {
> "filter": {
> "email": {
> "type": "pattern_capture",
> "preserve_original": "true",
> "patterns": [
> "([^@]+)",
> "(\\p{L}+)",
> "(\\d+)",
> "@(.+)"
> ]
> }
> },
> "analyzer": {
> "email": {
> "filter": [
> "email",
> "lowercase",
> "unique"
> ],
> "tokenizer": "uax_url_email"
> }
> }
> },
> "priority": "1000",
> "number_of_replicas": "0",
> "uuid": "lLLaDHaiTuSRvpMwRaAvsw",
> "version": {
> "created": "6010299"
> }
> }
> }
> }
> }
> 
> ```

```auto
/.security/user/_count?pretty

```

> **Response**
>
> ```auto
> {
> "count": 0,
> "_shards": {
> "total": 1,
> "successful": 1,
> "skipped": 0,
> "failed": 0
> }
> }
> 
> ```

```auto
/.security/doc/_count?pretty

```

> **Response**
>
> ```auto
> {
> "count": 53,
> "_shards": {
> "total": 1,
> "successful": 1,
> "skipped": 0,
> "failed": 0
> }
> }
> 
> ```

```auto
/.security/doc/_count?pretty
{ "query": { "term": { "type": "user" } } }

```

> **Response**
>
> ```auto
> {
> "count": 1,
> "_shards": {
> "total": 1,
> "successful": 1,
> "skipped": 0,
> "failed": 0
> }
> }
> 
> ```

We did run the migration assistant and did migrate all indices without any errors we were aware of.

Thanks for you help!  
Simon

---

<div class="post-metadata">

**Author:** ![stemps](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stemps/32/27242_2.png) [@stemps](https://discuss.elastic.co/u/stemps)\
**Post date:** [February 5, 2018, 9:49am UTC](https://discuss.elastic.co/t/cannot-see-non-reserved-users-and-roles-since-6-1-upgrade/117970/4 "2018-02-05T09:49:55Z")

</div>

@TimV can you see from the queries how we can make our users visible again?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 5, 2018, 12:23pm UTC](https://discuss.elastic.co/t/cannot-see-non-reserved-users-and-roles-since-6-1-upgrade/117970/5 "2018-02-05T12:23:51Z")

</div>

Sorry, Discourse can be somewhat unreliable about sending email replies so I only just saw your post.

I really don't understand what is happening here, I'll send you a private messages.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 5, 2018, 12:24pm UTC](https://discuss.elastic.co/t/cannot-see-non-reserved-users-and-roles-since-6-1-upgrade/117970/6 "2018-03-05T12:24:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.