# Field security level Kibana

**URL:** https://discuss.elastic.co/t/field-security-level-kibana/219039
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [February 12, 2020, 4:06pm UTC](https://discuss.elastic.co/t/field-security-level-kibana/219039 "2020-02-12T16:06:37Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![viku](https://avatars.discourse-cdn.com/v4/letter/v/c5a1d2/32.png) [@viku](https://discuss.elastic.co/u/viku)
#### Post date: [February 12, 2020, 4:06pm UTC](https://discuss.elastic.co/t/field-security-level-kibana/219039/1 "2020-02-12T16:06:37Z")

</div>

Hi,

I'm trying to set up field security level, but it doesn't seem to work.

I'm using the Elastic cloud trial (Deployment version v7.6.0) and the Flights dataset that comes as a demo.

I've created a role (flight\_data) with read privileges, and a user (flight-user) with that role.  
Then, I went to the Dev Tools and tried the following configuration following the documentation ([https://www.elastic.co/guide/en/elasticsearch/reference/current/field-level-security.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/field-level-security.html))

The idea is to create a role that can only see the data when the OriginCityName of the flights is "London"

POST /\_security/role/flight-data  
{  
"run\_as": ["flight-user"],  
"cluster": ["monitor"],  
"indices": [  
{  
"names": ["kibana\_sample\_data\_flights"],  
"privileges": ["read"],  
"field\_security" : {  
"grant" : ["\*"]  
},  
"query": "{"match": {"OriginCityName": "London"}}"  
}  
]  
}

However, that user can see all the data. So, what am I missing?

Thanks

---

<div class="post-metadata">

### Author: ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)
#### Post date: [February 12, 2020, 6:00pm UTC](https://discuss.elastic.co/t/field-security-level-kibana/219039/2 "2020-02-12T18:00:25Z")

</div>

What you want is [document level security](https://www.elastic.co/guide/en/elasticsearch/reference/current/field-and-document-access-control.html), to do that you need to create a new role like the one below that restricts read only to documents from `EZE` airport. Then you can assign that role to a new user.

```
POST /_security/role/eze-read
{
  "indices": [
    {
      "names": [
        "kibana_sample_data_flights"
      ],
      "privileges": [
        "read"
      ],
      "query": {
        "template": {
          "source": {
            "term": {
              "OriginAirportID": "EZE"
            }
          }
        }
      }
    }
  ]
}

```

If the user is called `eze` you can run this and see how the count is just `258`:

```
$ curl -u "eze:changeme" "localhost:9200/kibana_sample*/_count" 
{"count":258,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0}}

```

While if you do the same using the super user you get all the docs `13059`:

```
$ curl -u "elastic:changeme" "localhost:9200/kibana_sample*/_count" 
{"count":13059,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0}}

```

Let us know if this is what you need. Best.

---

<div class="post-metadata">

### Author: ![viku](https://avatars.discourse-cdn.com/v4/letter/v/c5a1d2/32.png) [@viku](https://discuss.elastic.co/u/viku)
#### Post date: [February 13, 2020, 7:47am UTC](https://discuss.elastic.co/t/field-security-level-kibana/219039/3 "2020-02-13T07:47:02Z")

</div>

Hi @jsanz

YES!! That was what I wanted to do. You nailed it.

Thank you very much 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2020, 7:47am UTC](https://discuss.elastic.co/t/field-security-level-kibana/219039/4 "2020-03-12T07:47:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.