I need to cipher some parts of my data and I think I can do it using the Logstash filters.
The difficult point of it is that I need two profiles: one which would be able to see deciphered data in Kibana and another that would have to see them ciphered.
One approach could be duplicating data and storing it in two ways (ciphered and no-ciphered) and having two Kibana instances. However, this has become impossible to do because the amount of data makes it unviable.
What could I do?
I'm not really sure there is another (easy) way - otherwise you'd need one of the Kibana instances to somehow decipher the data. I suppose you can fork it to do that ? 
At the end I realised not all the data was sensitive, so I ciphered only the logs that contains critical info. Doing so, the amount of duplicate data was much smaller. After that, I assigned each type to a different index and I used Shield to create users with different roles and permissions.
1 Like
Thanks for the update!