# How to grant access for specefic data in elastic cluster

**URL:** <https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575>\
**Category:** Elasticsearch\
**Created:** [October 9, 2020, 2:04pm UTC](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575 "2020-10-09T14:04:57Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abdelhalim](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Post date:** [October 9, 2020, 2:04pm UTC](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575/1 "2020-10-09T14:04:57Z")

</div>

Hello everybody,

let's suppose I have 2 machines where I run the same agent (packetbeat for example), how can I do to create 2 users where each user can only access data that has been created from one machine ?

so user\_1 can display in kibana only data of packetbeat of the machine 1 and user\_2 can only display logs of machine 2 !

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![kavierkoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavierkoo/32/86555_2.png) [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\
**Post date:** [October 9, 2020, 2:14pm UTC](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575/2 "2020-10-09T14:14:40Z")

</div>

There's function for `users` and `roles` in Elasticsearch

1. [Create roles](https://www.elastic.co/guide/en/elasticsearch/reference/current/get-started-roles.html#get-started-roles) (say role A and role B) to have access only data of packetbeat by specifying the index name

2. [Create user](https://www.elastic.co/guide/en/elasticsearch/reference/current/get-started-users.html#get-started-users) for user\_1 and user\_2, assign them to role A and role B

Hope this can help you

---

<div class="post-metadata">

**Author:** ![Abdelhalim](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Post date:** [October 9, 2020, 2:16pm UTC](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575/3 "2020-10-09T14:16:36Z")

</div>

thanks for your reply @kavierkoo,

But how can I do this as the index have the same name ?

---

<div class="post-metadata">

**Author:** ![kavierkoo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kavierkoo/32/86555_2.png) [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)\
**Post date:** [October 9, 2020, 2:43pm UTC](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575/4 "2020-10-09T14:43:43Z")

</div>

Two ways I could thought of:

1. Use a different index name

2. Create roles with Kibana `Grant read privileges to specific documents` or [API](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#_example_8) and use query to match field that is able to identify your device like `host`

---

<div class="post-metadata">

**Author:** ![Abdelhalim](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\
**Post date:** [October 9, 2020, 3:04pm UTC](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575/5 "2020-10-09T15:04:57Z")

</div>

Thanks for your answer  
I will try your suggestions and keep you in touch

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2020, 3:05pm UTC](https://discuss.elastic.co/t/how-to-grant-access-for-specefic-data-in-elastic-cluster/251575/6 "2020-11-06T15:05:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.