Greetings,
I need some guidance for creating new role to read an index within 24 hours only. I did test creating new role on kibana with dev tools
POST /_security/role/timestamp_restrict
{
"indices": [
{
"names": [ "project.test*" ],
"privileges": [ "read" ],
"query": {
"range": {
"@timestamp": {
"gte": "now-1d/d",
"lt": "now/d"
}
}
}
}
]
}
with that role, i created a new role mapping with role timestamp_restrict and kibana_user in it. But when i login with user within that role mapping, i get this error when accessing discover
Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"},
{"type":"parse_exception","reason":"could not read the current timestamp"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"project.test-2020.03.02","node":"hUR68P5GTPmNhww3wVqzyQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"CPDfVjB3Q4CKENqEzinZ7A","index":"project.test-2020.03.02","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.03","node":"GwincRpsS82FUZYZb_ncMQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"Vu9O5qJKSF6aoGhRCCYIpg","index":"project.test-2020.03.03","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.04","node":"LUWM0ZeFTX-H3P68v6k1-A","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"6eocCVzSS9-t6QB4XGsmFg","index":"project.test-2020.03.04","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.05","node":"hUR68P5GTPmNhww3wVqzyQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"Le19hZbYSaWL74rBsil53w","index":"project.test-2020.03.05","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.06","node":"LUWM0ZeFTX-H3P68v6k1-A","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"WaCJ7KhlQ8imE58F4rwbGg","index":"project.test-2020.03.06","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.07","node":"LUWM0ZeFTX-H3P68v6k1-A","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"nWGtzt6cR82KHdVs7x8MRA","index":"project.test-2020.03.07","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.08","node":"hUR68P5GTPmNhww3wVqzyQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"zAdl-kohRTq3uRCp3RUjaA","index":"project.test-2020.03.08","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.09","node":"LUWM0ZeFTX-H3P68v6k1-A","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"wYoQ6lrwQmajeFcSWoTSkg","index":"project.test-2020.03.09","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.10","node":"GwincRpsS82FUZYZb_ncMQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"MgKhRYSsRPauXxFIgHivOA","index":"project.test-2020.03.10","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.11","node":"LUWM0ZeFTX-H3P68v6k1-A","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"kJESPmBuQHSRqqkvF8gDqA","index":"project.test-2020.03.11","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.12","node":"LUWM0ZeFTX-H3P68v6k1-A","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"22Jvh9J1RWa5COAHv6c1ww","index":"project.test-2020.03.12","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.13","node":"LUWM0ZeFTX-H3P68v6k1-A","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"QsCbDDpJQtKlu-gf85LrgA","index":"project.test-2020.03.13","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.14","node":"LUWM0ZeFTX-H3P68v6k1-A","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"ZJtcZ0rrSnSCdUAZet95dA","index":"project.test-2020.03.14","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.15","node":"GwincRpsS82FUZYZb_ncMQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"AaEMgLxiS4mV3yyDUCjWyQ","index":"project.test-2020.03.15","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.16","node":"hUR68P5GTPmNhww3wVqzyQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"7-5njIZgSRmbj-sKRWpwgA","index":"project.test-2020.03.16","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}},{"shard":0,"index":"project.test-2020.03.17","node":"GwincRpsS82FUZYZb_ncMQ","reason":{"type":"query_shard_exception","reason":"failed to create query: {\n \"range\" : {\n \"@timestamp\" : {\n \"from\" : \"now-1d/d\",\n \"to\" : \"now/d\",\n \"include_lower\" : true,\n \"include_upper\" : false,\n \"boost\" : 1.0\n }\n }\n}","index_uuid":"v4k4K0ytRzCRMfpfP5ZH3Q","index":"project.test-2020.03.17","caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}}}],"caused_by":{"type":"parse_exception","reason":"could not read the current timestamp","caused_by":{"type":"illegal_argument_exception","reason":"permission filters are not allowed to use the current timestamp"}}},"status":400}
is there something wrong in the query when i create a role ?
Thanks