# Courier Fetch Error when using document level filtering
**URL:** https://discuss.elastic.co/t/courier-fetch-error-when-using-document-level-filtering/40847
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [February 3, 2016, 9:27am UTC](https://discuss.elastic.co/t/courier-fetch-error-when-using-document-level-filtering/40847 "2016-02-03T09:27:02Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@thomasno](https://discuss.elastic.co/u/thomasno)
#### Post date: [February 3, 2016, 9:27am UTC](https://discuss.elastic.co/t/courier-fetch-error-when-using-document-level-filtering/40847/1 "2016-02-03T09:27:03Z")
I'm having a issue when trying to use the document level filtering feature in the roles.yml file. When I try to enable it I am presented with the following error
```
Courier Fetch Error: unhandled courier request error: [security_exception] action [indices:data/read/mget] is unauthorized for user [csi_user]
```
Here is the Shield section of elasticsearch.yml
```
shield:
dls_fls.enabled: true
authc:
realms:
esusers1:
type: esusers
order: 0
```
The role form roles.yml
```
Customer1_ro:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'logstash-*':
privileges: read
query:
term:
Customer.raw: "Customer1"
'.kibana':
- indices:admin/create
- indices:admin/exists
- indices:admin/mapping/put
- indices:admin/mappings/fields/get
- indices:admin/refresh
- indices:admin/validate/query
- indices:data/read/get
- indices:data/read/mget
- indices:data/read/search
- indices:data/write/delete
- indices:data/write/index
- indices:data/write/update
```
Error from the logs:
```
[2016-02-03 10:21:48,851][INFO][rest.suppressed] /_mget Params: {preference=1454494892371, timeout=0, ignore_unavailable=true}
ElasticsearchSecurityException[action [indices:data/read/mget] is unauthorized for user [csi_user]]
at org.elasticsearch.shield.support.Exceptions.authorizationError(Exceptions.java:45)
at org.elasticsearch.shield.authz.InternalAuthorizationService.denialException(InternalAuthorizationService.java:294)
at org.elasticsearch.shield.authz.InternalAuthorizationService.denial(InternalAuthorizationService.java:268)
at org.elasticsearch.shield.authz.InternalAuthorizationService.authorize(InternalAuthorizationService.java:129)
at org.elasticsearch.shield.action.ShieldActionFilter.apply(ShieldActionFilter.java:105)
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:99)
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:77)
at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:58)
at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:347)
at org.elasticsearch.client.FilterClient.doExecute(FilterClient.java:52)
at org.elasticsearch.rest.BaseRestHandler$HeadersAndContextCopyClient.doExecute(BaseRestHandler.java:83)
at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:347)
at org.elasticsearch.client.support.AbstractClient.multiGet(AbstractClient.java:555)
at org.elasticsearch.rest.action.get.RestMultiGetAction.handleRequest(RestMultiGetAction.java:70)
at org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:54)
at org.elasticsearch.rest.RestController.executeHandler(RestController.java:207)
at org.elasticsearch.rest.RestController$RestHandlerFilter.process(RestController.java:281)
at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:262)
at org.elasticsearch.shield.rest.ShieldRestFilter.process(ShieldRestFilter.java:77)
at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:265)
at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:176)
at org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:128)
at org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:86)
at org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:348)
at org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:63)
......
```
I have tried many different configurations but having no luck. Any help would be much appreciated.
Note\* If I remove the query section everything is fine.
---
### Author:  [@mvg](https://discuss.elastic.co/u/mvg)
#### Post date: [February 3, 2016, 10:02am UTC](https://discuss.elastic.co/t/courier-fetch-error-when-using-document-level-filtering/40847/2 "2016-02-03T10:02:03Z")
Do you see any of this these error logs:
invalid role definition [Customer1\_ro] in roles file
The indentation in your yaml files look incorrect, so I think the roles and settings aren't picked up correctly. For example the spaces required before the second line here:
```auto
shield:
dls_fls.enabled: true
```
---
### Author:  [@thomasno](https://discuss.elastic.co/u/thomasno)
#### Post date: [February 3, 2016, 10:26am UTC](https://discuss.elastic.co/t/courier-fetch-error-when-using-document-level-filtering/40847/3 "2016-02-03T10:26:56Z")
Sorry the incorrect indentation was just bad formatting in the post I have corrected.
As for the "Invalid role definition [Customer1\_ro]" I dont see that in the logs when trying to access kibana with a user of this role, I do a error I have added it above.
Also to point out, this role works fine once the query section is reomved.
---
### Author:  [@baha](https://discuss.elastic.co/u/baha)
#### Post date: [February 9, 2016, 9:53pm UTC](https://discuss.elastic.co/t/courier-fetch-error-when-using-document-level-filtering/40847/4 "2016-02-09T21:53:33Z")
Can you please send the mapping of your index and also an example of the document you are trying to fetch?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/courier-fetch-error-when-using-document-level-filtering/40847/5 "2017-07-06T13:46:58Z")