Generated reports no access for user with limited index patterns

Elastic Stack Elasticsearch
1

Hi, I'm having issue with generated reports.
When use the user with the role that have read access to * index pattern, report is generated with data.
But if a role only have access to specific index pattern eg. mylogs-*
The report is generated but have no data and just error message inside. Role also is specified with Kibana all privileges and index privileges are specified as all.

ELK version: 8.14.1
Error:

"Encountered an unknown error: security_exception
	Root causes:
		security_exception: action [indices:data/read/search] is unauthorized for user [test] with effective roles [testrole], this action is granted by the index privileges [read,all]"
"Encountered an error with the number of CSV rows generated from the search: expected rows were indeterminable, received 0."

Tried also in addition giving role access to:
.monitoring-*
.ds-*

but no difference and same error.

Kr,
Tomasz

2

I face the same issue on a ELK 8.13.4.

The only additional information I can provide is that I have a second platform running ELK 8.4.2 with the exact same index, roles, users created and the problem does not exists there.

3

The role of the user having an issue to export CSV in 8.13.4 (while this work in 8.4.2) was due to the fact that his role gave him access to the indices “log-filebeat-alias”.

I added the “log*” and this suddenly worked back in 8.16.4.

It therefore seems that giving access to indices using aliases is not working anymore.

4

log* is a pattern of your indicies or some generic pattern?

On 8.14.1 after adding read to that logs* still same issue.