Sorry, I should have clarified; the plan is to provision access to the new index via a new role:
rabbitmq_user:
cluster:
- monitor
indices:
- names: 'logstash-application-rabbitmq-*'
privileges:
- view_index_metadata
- read
But since my current role specifies - names: 'logstash-*' I believe I would have to change it to what I specified above. Just wanted to make sure there wasn't some option like this available:
kibana_user:
cluster:
- monitor
indices:
- names: 'logstash-*'
privileges:
- view_index_metadata
- read
- excludes: 'logstash-application-rabbitmq-*'