# Elasticsearch access control based on field value
**URL:** https://discuss.elastic.co/t/elasticsearch-access-control-based-on-field-value/22940
**Category:** Elasticsearch
**Created:** [March 27, 2015, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-access-control-based-on-field-value/22940 "2015-03-27T08:39:24Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Philipp\_R](https://discuss.elastic.co/u/Philipp_R)
#### Post date: [March 27, 2015, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-access-control-based-on-field-value/22940/1 "2015-03-27T08:39:24Z")
I am currently investigating the ELK (Elasticsearch, Logstash, Kibana)
stack for centralized log file analysis.
The plan is to store logs of multiple applications in the same
Elasticsearch cluster using logstash and day-based indexes.
All documents contain a field called application, e.g."application":
"superapp".
Now we are looking for a way to implement access control like this:
_A) Superuser:_ is able to see log entries of all applications.
_B) Developer:_ can only see log entries of the applications he is allowed
to. For example the dev team for application "superapp" should only be able
to see the entries for this application.
To wrap it up: we need access control based on the value in the field
application.
While reading the documentation for Elastisearch and Shield I could not
find an obvious way to do it.
Any ideas how we could realize this in a way that would also work with
Kibana 3 and 4?
My first idea was to use aliases which are being automatically assigned to
documents using index templates. I am wondering if this is the right
direction.
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 27, 2015, 9:17am UTC](https://discuss.elastic.co/t/elasticsearch-access-control-based-on-field-value/22940/2 "2015-03-27T09:17:06Z")
Aliases + shield will definitely do this.
On 27 March 2015 at 19:39, Philipp R. [p.rossberger@googlemail.com](mailto:p.rossberger@googlemail.com) wrote:
> I am currently investigating the ELK (Elasticsearch, Logstash, Kibana)
> stack for centralized log file analysis.
>
> The plan is to store logs of multiple applications in the same
> Elasticsearch cluster using logstash and day-based indexes.
>
> All documents contain a field called application, e.g."application":
> "superapp".
>
> Now we are looking for a way to implement access control like this:
>
> _A) Superuser:_ is able to see log entries of all applications.
>
> _B) Developer:_ can only see log entries of the applications he is
> allowed to. For example the dev team for application "superapp" should only
> be able to see the entries for this application.
>
> To wrap it up: we need access control based on the value in the field
> application.
>
> While reading the documentation for Elastisearch and Shield I could not
> find an obvious way to do it.
>
> Any ideas how we could realize this in a way that would also work with
> Kibana 3 and 4?
>
> My first idea was to use aliases which are being automatically assigned to
> documents using index templates. I am wondering if this is the right
> direction.
>
> --
> You received this message because you are subscribed to the Google Groups
> "elasticsearch" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> To view this discussion on the web visit
> [https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com)
> [https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com?utm_medium=email&utm_source=footer)
> .
> For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X\_41dhfdHAp0C-wKgBLh3CpppiMUeiDc6wEd7ToN8%2Baaw%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X_41dhfdHAp0C-wKgBLh3CpppiMUeiDc6wEd7ToN8%2Baaw%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Philipp\_R](https://discuss.elastic.co/u/Philipp_R)
#### Post date: [March 27, 2015, 10:24am UTC](https://discuss.elastic.co/t/elasticsearch-access-control-based-on-field-value/22940/3 "2015-03-27T10:24:08Z")
Hi Mark,
could you please elaborate a little more detailed how this could be done?
Would you suggest indexes per application and tie them together via
aliases? Still wonder how this could be integrated into Kibana...
Best regards,
Philipp
Am Freitag, 27. März 2015 10:17:37 UTC+1 schrieb Mark Walkom:
> Aliases + shield will definitely do this.
>
> On 27 March 2015 at 19:39, Philipp R. \<[p.ross...@googlemail.com](mailto:p.ross...@googlemail.com)
> \\> wrote:
>
> > I am currently investigating the ELK (Elasticsearch, Logstash, Kibana)
> > stack for centralized log file analysis.
> >
> > The plan is to store logs of multiple applications in the same
> > Elasticsearch cluster using logstash and day-based indexes.
> >
> > All documents contain a field called application, e.g."application":
> > "superapp".
> >
> > Now we are looking for a way to implement access control like this:
> >
> > _A) Superuser:_ is able to see log entries of all applications.
> >
> > _B) Developer:_ can only see log entries of the applications he is
> > allowed to. For example the dev team for application "superapp" should only
> > be able to see the entries for this application.
> >
> > To wrap it up: we need access control based on the value in the field
> > application.
> >
> > While reading the documentation for Elastisearch and Shield I could not
> > find an obvious way to do it.
> >
> > Any ideas how we could realize this in a way that would also work with
> > Kibana 3 and 4?
> >
> > My first idea was to use aliases which are being automatically assigned
> > to documents using index templates. I am wondering if this is the right
> > direction.
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [March 28, 2015, 5:45am UTC](https://discuss.elastic.co/t/elasticsearch-access-control-based-on-field-value/22940/4 "2015-03-28T05:45:19Z")
This is where it gets hard and you need to leverage your own domain
knowledge.
You can separate out the different types of logs into their own indices
which would make things much easier, you could also setup an alias with a
filter and then provide access to that alias to certain users.
Currently KB isn't multi-tenanted but it is a feature that is going to be
added, you'd have to setup multiple instances with each going to their own
alias.
On 27 March 2015 at 21:24, Philipp R. [p.rossberger@googlemail.com](mailto:p.rossberger@googlemail.com) wrote:
> Hi Mark,
>
> could you please elaborate a little more detailed how this could be done?
> Would you suggest indexes per application and tie them together via
> aliases? Still wonder how this could be integrated into Kibana...
>
> Best regards,
>
> Philipp
>
> Am Freitag, 27. März 2015 10:17:37 UTC+1 schrieb Mark Walkom:
>
> > Aliases + shield will definitely do this.
> >
> > On 27 March 2015 at 19:39, Philipp R. [p.ross...@googlemail.com](mailto:p.ross...@googlemail.com) wrote:
> >
> > > I am currently investigating the ELK (Elasticsearch, Logstash, Kibana)
> > > stack for centralized log file analysis.
> > >
> > > The plan is to store logs of multiple applications in the same
> > > Elasticsearch cluster using logstash and day-based indexes.
> > >
> > > All documents contain a field called application, e.g."application":
> > > "superapp".
> > >
> > > Now we are looking for a way to implement access control like this:
> > >
> > > _A) Superuser:_ is able to see log entries of all applications.
> > >
> > > _B) Developer:_ can only see log entries of the applications he is
> > > allowed to. For example the dev team for application "superapp" should only
> > > be able to see the entries for this application.
> > >
> > > To wrap it up: we need access control based on the value in the field
> > > application.
> > >
> > > While reading the documentation for Elastisearch and Shield I could not
> > > find an obvious way to do it.
> > >
> > > Any ideas how we could realize this in a way that would also work with
> > > Kibana 3 and 4?
> > >
> > > My first idea was to use aliases which are being automatically assigned
> > > to documents using index templates. I am wondering if this is the right
> > > direction.
> > >
> > > --
> > > You received this message because you are subscribed to the Google
> > > Groups "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send
> > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com).
> > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/)
> > > msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%
> > > [40googlegroups.com](http://40googlegroups.com)
> > > [https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> >
> > --
> > You received this message because you are subscribed to the Google Groups
> > "elasticsearch" group.
> > To unsubscribe from this group and stop receiving emails from it, send an
> > email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
> > To view this discussion on the web visit
> > [https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com)
> > [https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com?utm_medium=email&utm_source=footer)
> > .
> > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-nqgdnkyfKtbeUwQPOWXdfbGs3LcJArFvA%3DS3ij4q3CQ%40mail.gmail.com](https://groups.google.com/d/msgid/elasticsearch/CAEYi1X-nqgdnkyfKtbeUwQPOWXdfbGs3LcJArFvA%3DS3ij4q3CQ%40mail.gmail.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@Philipp\_R](https://discuss.elastic.co/u/Philipp_R)
#### Post date: [April 7, 2015, 11:55am UTC](https://discuss.elastic.co/t/elasticsearch-access-control-based-on-field-value/22940/5 "2015-04-07T11:55:33Z")
When you mention to "setup an alias with a filter", you mean a setup along
these lines,
right? [Faking Index per User with Aliases | Elasticsearch: The Definitive Guide [master] | Elastic](http://www.elastic.co/guide/en/elasticsearch/guide/master/faking-it.html)
Regarding search performance: would you recommend using aliases+filters or
separate indexes per application?
Am Samstag, 28. März 2015 06:46:00 UTC+1 schrieb Mark Walkom:
> This is where it gets hard and you need to leverage your own domain
> knowledge.
>
> You can separate out the different types of logs into their own indices
> which would make things much easier, you could also setup an alias with a
> filter and then provide access to that alias to certain users.
> Currently KB isn't multi-tenanted but it is a feature that is going to be
> added, you'd have to setup multiple instances with each going to their own
> alias.
>
> On 27 March 2015 at 21:24, Philipp R. \<[p.ross...@googlemail.com](mailto:p.ross...@googlemail.com)
> \\> wrote:
>
> > Hi Mark,
> >
> > could you please elaborate a little more detailed how this could be done?
> > Would you suggest indexes per application and tie them together via
> > aliases? Still wonder how this could be integrated into Kibana...
> >
> > Best regards,
> >
> > Philipp
> >
> > Am Freitag, 27. März 2015 10:17:37 UTC+1 schrieb Mark Walkom:
> >
> > > Aliases + shield will definitely do this.
> > >
> > > On 27 March 2015 at 19:39, Philipp R. [p.ross...@googlemail.com](mailto:p.ross...@googlemail.com) wrote:
> > >
> > > > I am currently investigating the ELK (Elasticsearch, Logstash, Kibana)
> > > > stack for centralized log file analysis.
> > > >
> > > > The plan is to store logs of multiple applications in the same
> > > > Elasticsearch cluster using logstash and day-based indexes.
> > > >
> > > > All documents contain a field called application, e.g."application":
> > > > "superapp".
> > > >
> > > > Now we are looking for a way to implement access control like this:
> > > >
> > > > _A) Superuser:_ is able to see log entries of all applications.
> > > >
> > > > _B) Developer:_ can only see log entries of the applications he is
> > > > allowed to. For example the dev team for application "superapp" should only
> > > > be able to see the entries for this application.
> > > >
> > > > To wrap it up: we need access control based on the value in the field
> > > > application.
> > > >
> > > > While reading the documentation for Elastisearch and Shield I could not
> > > > find an obvious way to do it.
> > > >
> > > > Any ideas how we could realize this in a way that would also work with
> > > > Kibana 3 and 4?
> > > >
> > > > My first idea was to use aliases which are being automatically assigned
> > > > to documents using index templates. I am wondering if this is the right
> > > > direction.
> > > >
> > > > --
> > > > You received this message because you are subscribed to the Google
> > > > Groups "elasticsearch" group.
> > > > To unsubscribe from this group and stop receiving emails from it, send
> > > > an email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com).
> > > > To view this discussion on the web visit [https://groups.google.com/d/](https://groups.google.com/d/)
> > > > msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%
> > > > [40googlegroups.com](http://40googlegroups.com)
> > > > [https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/54593215-2f62-47c5-ac87-5e3515a9b916%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > > .
> > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
> > >
> > > --
> > > You received this message because you are subscribed to the Google Groups
> > > "elasticsearch" group.
> > > To unsubscribe from this group and stop receiving emails from it, send an
> > > email to [elasticsearc...@googlegroups.com](mailto:elasticsearc...@googlegroups.com) \.
> > > To view this discussion on the web visit
> > > [https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com)
> > > [https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com?utm\_medium=email&utm\_source=footer](https://groups.google.com/d/msgid/elasticsearch/bf6b1a97-060d-43cb-b1ab-53d0172eb39e%40googlegroups.com?utm_medium=email&utm_source=footer)
> > > .
> > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/c24b62c6-03f2-4787-bf9d-894d7dad671a%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/c24b62c6-03f2-4787-bf9d-894d7dad671a%40googlegroups.com).
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 12:21am UTC](https://discuss.elastic.co/t/elasticsearch-access-control-based-on-field-value/22940/6 "2017-07-06T00:21:12Z")