# Document level security in Kibana with X Pack

**URL:** <https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556>\
**Category:** Kibana\
**Created:** [June 7, 2017, 10:51am UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556 "2017-06-07T10:51:31Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![annette](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@annette](https://discuss.elastic.co/u/annette)\
**Post date:** [June 7, 2017, 10:51am UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556/1 "2017-06-07T10:51:31Z")

</div>

i am trying to set up roles for users to log in but only see documents that is related to them.

This is the role that i created:

```
  {
      "events_admin": {
        "cluster": [],
        "indices": [
          {
            "names": [
              "events*",
              ".kibana*"
            ],
            "privileges": [
              "all"
            ],
            "query": """{"term":{"Consultant.keyword":"Terri"}}"""
          }
        ],
        "run_as": [],
        "metadata": {},
        "transient_metadata": {
          "enabled": true
        }
      }
    }

```

When i log in as this user i get the following error:  
`Config: Error 400 Bad Request: [security_exception] Can't execute an update request if field or document level security is enabled`  
I followed a example on [Setting Up Field and Document Level Security | X-Pack for the Elastic Stack [6.2] | Elastic](https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html) to create this roll:

> For example, the following role grants read access to all indices, but restricts access to documents whose department\_id equals 12.

> ```
> {
> "indices" : [
> {
> "names" : ["*"],
> "privileges" : ["read"],
> "query" : {
> "term" : { "department_id" : 12 }
> }
> }
> ]
> }
> 
> ```

But then i found the following:

> [Limitations | X-Pack for the Elastic Stack [5.1] | Elastic](https://www.elastic.co/guide/en/x-pack/5.1/security-limitations.html#_field_and_document_level_security_limitations)

> Any query that makes remote calls to fetch data to query by isn’t supported. The following queries aren’t supported:

> The terms query with terms lookup isn’t supported.  
> The geo\_shape query with indexed shapes isn’t supported.  
> The percolate query isn’t supported.

Okay so can someone please give me the correct answer...  
In Kibana with X Pack - Can i set up a role where the user will only be able to see the documents where the _"Consultant"_ field is there name?

If so, please help... what am i doing wrong?

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [June 7, 2017, 7:32pm UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556/2 "2017-06-07T19:32:59Z")

</div>

try to remove ".kibana\*" from the indices list in the role definition.

---

<div class="post-metadata">

**Author:** ![annette](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@annette](https://discuss.elastic.co/u/annette)\
**Post date:** [June 8, 2017, 5:57am UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556/3 "2017-06-08T05:57:34Z")

</div>

Removed ".kibana\*" and now getting this error:

> Config: Error 403 Forbidden: [security\_exception] action [indices:data/write/update] is unauthorized for user [user2]

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [June 8, 2017, 10:37am UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556/4 "2017-06-08T10:37:11Z")

</div>

try to give the user `user2` the `kibana_user` role

---

<div class="post-metadata">

**Author:** ![annette](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@annette](https://discuss.elastic.co/u/annette)\
**Post date:** [June 8, 2017, 1:18pm UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556/5 "2017-06-08T13:18:46Z")

</div>

With the kibana\_user role i can not add the query as to what documents are allowed.

I can assign a roll to a user and they are able to see all documents but I need to limit what documents they are allowed to see.

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [June 9, 2017, 6:19am UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556/6 "2017-06-09T06:19:23Z")

</div>

`user2` should have both roles: `kibana_user` and your custom `events_admin` (see: [User management API](https://www.elastic.co/guide/en/x-pack/current/security-api-users.html)), something like that:

```
PUT /_xpack/security/user/user2
{
    "roles": [
      "kibana_user",
      "events_admin"
    ]
}
```

---

<div class="post-metadata">

**Author:** ![annette](https://avatars.discourse-cdn.com/v4/letter/a/c57346/32.png) [@annette](https://discuss.elastic.co/u/annette)\
**Post date:** [June 9, 2017, 12:26pm UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556/7 "2017-06-09T12:26:47Z")

</div>

Thanks - Tested it and it works. Great stuff.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2017, 12:27pm UTC](https://discuss.elastic.co/t/document-level-security-in-kibana-with-x-pack/88556/8 "2017-07-07T12:27:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.