# Config a role in roles.yml but cannot specify some privileges

**URL:** <https://discuss.elastic.co/t/config-a-role-in-roles-yml-but-cannot-specify-some-privileges/190096>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [July 11, 2019, 7:00pm UTC](https://discuss.elastic.co/t/config-a-role-in-roles-yml-but-cannot-specify-some-privileges/190096 "2019-07-11T19:00:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![xujohn](https://avatars.discourse-cdn.com/v4/letter/x/c0e974/32.png) [@xujohn](https://discuss.elastic.co/u/xujohn)\
**Post date:** [July 11, 2019, 7:00pm UTC](https://discuss.elastic.co/t/config-a-role-in-roles-yml-but-cannot-specify-some-privileges/190096/1 "2019-07-11T19:00:16Z")

</div>

I defined a customer role in roles.yml such as:

my\_user\_role:  
cluster: ['all']  
indices:  
- names: ['_']  
privileges: ['all']  
applications: ['_']  
run\_as: ['\*']

After starting elasticsearch and logged in kibana to look the roles:

GET /\_security/role/my\_user\_role

I found the run\_as and applications are empty arrays , no matter how I put values inside.

Why do the values not shown in privileges such as applications and run\_as?

The out put from GET returns :

{  
"my\_user\_role" : {  
"cluster" : [  
"all"  
],  
"indices" : [  
{  
"names" : [  
"\*"  
],  
"privileges" : [  
"read"  
],  
"allow\_restricted\_indices" : false  
}  
],  
"applications" : [],  
"run\_as" : [],  
"metadata" : { },  
"transient\_metadata" : {  
"enabled" : true  
}  
}  
}

Thank you.

John

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 12, 2019, 4:29am UTC](https://discuss.elastic.co/t/config-a-role-in-roles-yml-but-cannot-specify-some-privileges/190096/2 "2019-07-12T04:29:27Z")

</div>

Roles defined through the API and roles defined in `roles.yml` are separate.  
You cannot use the API to view roles.yml

---

<div class="post-metadata">

**Author:** ![xujohn](https://avatars.discourse-cdn.com/v4/letter/x/c0e974/32.png) [@xujohn](https://discuss.elastic.co/u/xujohn)\
**Post date:** [July 12, 2019, 3:02pm UTC](https://discuss.elastic.co/t/config-a-role-in-roles-yml-but-cannot-specify-some-privileges/190096/3 "2019-07-12T15:02:40Z")

</div>

Thank you Tim. Do you mean I can define role1 in roles.yml and role1 (exactly same name) in API the same time? Which, API one or yml one, will be picked up by elastic search?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 16, 2019, 7:34am UTC](https://discuss.elastic.co/t/config-a-role-in-roles-yml-but-cannot-specify-some-privileges/190096/4 "2019-07-16T07:34:38Z")

</div>

> [@xujohn](#):
>
> Which, API one or yml one, will be picked up by Elasticsearch?

It will pick up the yml one.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2019, 7:34am UTC](https://discuss.elastic.co/t/config-a-role-in-roles-yml-but-cannot-specify-some-privileges/190096/5 "2019-08-13T07:34:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.