# Field level security

**URL:** <https://discuss.elastic.co/t/field-level-security/203573>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 15, 2019, 7:20am UTC](https://discuss.elastic.co/t/field-level-security/203573 "2019-10-15T07:20:19Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nee\_Defeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nee_defeng/32/45771_2.png) [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Post date:** [October 15, 2019, 7:20am UTC](https://discuss.elastic.co/t/field-level-security/203573/1 "2019-10-15T07:20:19Z")

</div>

I am trying to setup one role to have read permission on particular fields, but the testing is a bit confusing.

In Role Management, I choose one indice with Read privilege, and then turn on the Grant Access to specific field and choose a few fields.

```
{
  "doc-readonly" : {
    "cluster" : [],
    "indices" : [
      {
        "names" : [
          "myfirstfsjob*"
        ],
        "privileges" : [
          "read"
        ],
        "field_security" : {
          "grant" : [
            "content",
            "path.real.fulltext",
            "meta.keywords"
          ],
          "except" : []
        },
        "allow_restricted_indices" : false
      }
    ],
    "applications" : [],
    "run_as" : [
      "elastic"
    ],
    "metadata" : { },
    "transient_metadata" : {
      "enabled" : true
    }
  }
}

```

Now in Kibana, I am not able to query any data (while the same query returns result prior to the role setup).

Here is the Kibana query result (using readonly aka ro):

 ![com%20-%20Outlook](https://us1.discourse-cdn.com/elastic/original/3X/6/d/6d7baf3b14910d6ba940a1f2537b0fe91176fcab.png)

At the same time, the GET \_Search API returns all documents (Unexpected) with the list of fields (Expected).

Here is the excerpt of the return (using 'ro' user which has 'doc-readonly' role):

```
sni@elk:~$ sudo curl -H 'Content-Type: application/json' -s --cacert ca.crt -u ro:xxx -XPOST https://localhost:9200/_search?pretty&q=content:DBS
[1] 7424
sni@elk:~$ {
  "took" : 6,
  "timed_out" : false,
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : 1.0,
    "hits" : [
      {

```

Any thoughts?

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 15, 2019, 8:19am UTC](https://discuss.elastic.co/t/field-level-security/203573/2 "2019-10-15T08:19:03Z")

</div>

Please be a little more explicit in your example and share some more details so that we can help you.

- Can you share the role definition ? From kibana dev tools ( logged in as a prvileged user ) run `GET _security/role/<the_name_of_the_role_here>`

- As which user do you run " the GET \_Search API " ? Does this user have the aforementioned role ? Do you use kibana dev tools or the elasticsearch REST API directly?

---

<div class="post-metadata">

**Author:** ![Nee\_Defeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nee_defeng/32/45771_2.png) [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Post date:** [October 15, 2019, 9:21am UTC](https://discuss.elastic.co/t/field-level-security/203573/3 "2019-10-15T09:21:29Z")

</div>

Sorry, and please see my edited post.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 15, 2019, 9:51am UTC](https://discuss.elastic.co/t/field-level-security/203573/4 "2019-10-15T09:51:34Z")

</div>

Hi again,

> At the same time, the GET \_Search API returns all documents (Unexpected)

Field Level Security controls the fields in the documents that the user has access to and not the documents themselves. Your role says that the user has read access to all the indices that match the index pattern `myfirstfsjob*` and should only be able to read `"content", "path.real.fulltext", "meta.keywords"` fields.

You can read through our documentation in [Setting up field and document level security | Elasticsearch Guide [7.4] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/field-and-document-access-control.html) and if you have further question about how this works, feel free to reach out!

---

<div class="post-metadata">

**Author:** ![Nee\_Defeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nee_defeng/32/45771_2.png) [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Post date:** [October 15, 2019, 11:08am UTC](https://discuss.elastic.co/t/field-level-security/203573/5 "2019-10-15T11:08:06Z")

</div>

Thank Ioannis,

But here my question is around why Kibana did not return any documents since it was configured for the field.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 15, 2019, 11:16am UTC](https://discuss.elastic.co/t/field-level-security/203573/6 "2019-10-15T11:16:21Z")

</div>

Not sure. While logged in as your `ro` user, can you run these following requests from the kibana dev tools ?

```auto
GET /_security/_authenticate

```

and

```auto
GET /_search

```

and share the results ?

---

<div class="post-metadata">

**Author:** ![Nee\_Defeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nee_defeng/32/45771_2.png) [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Post date:** [October 15, 2019, 11:45am UTC](https://discuss.elastic.co/t/field-level-security/203573/7 "2019-10-15T11:45:14Z")

</div>

> [@ikakavas](#):
>
> GET /\_security/\_authenticate

Yes, here it is:

```
{
  "username" : "ro",
  "roles" : [
    "doc-readonly",
    "kibana_user"
  ],
  "full_name" : "readonly",
  "email" : "ro@tongyao.com.au",
  "metadata" : { },
  "enabled" : true,
  "authentication_realm" : {
    "name" : "default_native",
    "type" : "native"
  },
  "lookup_realm" : {
    "name" : "default_native",
    "type" : "native"
  }
}

```

and

```
{
  "took" : 4,
  "timed_out" : false,
  "_shards" : {
    "total" : 2,
    "successful" : 2,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 10000,
      "relation" : "gte"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "myfirstfsjob",
        "_type" : "_doc",
        "_id" : "e2d83ef7979136474d4f8f911c5821d",
        "_score" : 1.0,
        "_source" : {
          "content" : """

```

---

<div class="post-metadata">

**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\
**Post date:** [October 16, 2019, 3:47am UTC](https://discuss.elastic.co/t/field-level-security/203573/8 "2019-10-16T03:47:35Z")

</div>

Hi @Nee_Defeng,

Thank you for sharing the output, though the output for `GET /_search` is truncated so of not much use.

> Now in Kibana, I am not able to query any data (while the same query returns result prior to the role setup).  
> Here is the Kibana query result (using readonly aka ro):

Not sure but the image that you shared for Kibana does not even show you fields like `_id`, `_index`, that is weird.  
It can happen only if there is no index that matches the pattern and it would look something like what you see there.  
Can you please try to refresh the index patterns in the Kibana UI and check? Or maybe delete the index pattern and recreate it.

Hope this helps.

Thanks and Regards,  
Yogesh Gaikwad

---

<div class="post-metadata">

**Author:** ![Nee\_Defeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nee_defeng/32/45771_2.png) [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Post date:** [October 17, 2019, 4:25am UTC](https://discuss.elastic.co/t/field-level-security/203573/9 "2019-10-17T04:25:25Z")

</div>

Thanks Yogesh, I think I found the root cause of this behaviour: the timestamp field was not granted for this user. As soon as I grant the file.created to this user, all the documents returned ( with \* as query) but the fields are empty (-).

One interesting thing is that, with all the returned documents, only these fields are listed. Why is it so?

 ![2019-10-17%2015_13_04-Discover%20-%20Kibana](https://us1.discourse-cdn.com/elastic/original/3X/0/f/0fcaab737ed3a48c5691ebe6b2f4e0ecc5f3e586.png)

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [October 17, 2019, 4:52am UTC](https://discuss.elastic.co/t/field-level-security/203573/10 "2019-10-17T04:52:34Z")

</div>

> [@Nee\_Defeng](#):
>
> One interesting thing is that, with all the returned documents, only these fields are listed. Why is it so?

You haven't shown us an example of your documents (so that we can see the fields ) and the updated role with the FLS part grants so it gets tricky to answer this. Can you share an example of a doc ? ( feel free to scrub out the values)

---

<div class="post-metadata">

**Author:** ![Nee\_Defeng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nee_defeng/32/45771_2.png) [@Nee\_Defeng](https://discuss.elastic.co/u/Nee_Defeng)\
**Post date:** [October 17, 2019, 4:58am UTC](https://discuss.elastic.co/t/field-level-security/203573/11 "2019-10-17T04:58:24Z")

</div>

![2019-10-17%2015_57_29-](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7c68f1ff6f856fa65701243470ab13b1e38f3f38.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 14, 2019, 4:58am UTC](https://discuss.elastic.co/t/field-level-security/203573/12 "2019-11-14T04:58:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.