We have some users that need to view the data in the dashboards and query via discover. We've given them kibana_user role but they can also make changes to advanced settings and access dev tools on indices they have rights to. The kibana_dashboard_only_user role doesn't give them rights to discover which they need. We are on 6.3.
Anyway we can clone kibana_user role that doesn't include manage or delete privileges or create a new role that had .kibana* privileges?