# How to implement Field level Security with X-Pack?

**URL:** https://discuss.elastic.co/t/how-to-implement-field-level-security-with-x-pack/99136
**Category:** Elasticsearch
**Created:** [September 1, 2017, 1:52pm UTC](https://discuss.elastic.co/t/how-to-implement-field-level-security-with-x-pack/99136 "2017-09-01T13:52:42Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)
#### Post date: [September 1, 2017, 1:52pm UTC](https://discuss.elastic.co/t/how-to-implement-field-level-security-with-x-pack/99136/1 "2017-09-01T13:52:42Z")

</div>

Hi Experts,

I was checking the docs and it says I can restrict user to a certain fields as well with X-Pack. So this is what I am doing .

> ```
> POST /_xpack/security/role/testing
> {
> "indices" : [
> {
> "names":[".kibana","abc"],
> "privileges": ["read"],
> "field_security": {
> "grant": ["src"]
> }
>             
> }
> ]
> } 
> 
> ```

Now assigning this role to a user

> POST /\_xpack/security/user/test  
> {  
> "password" : "abc123",  
> "roles" : ["kibana\_user", "testing"],  
> "full\_name" : "test user",  
> "email" : "[test@test.com](mailto:test@test.com)"
> 
> }

After above I can see the role and user been created in Kibana management page . But when I login into kibana with this user I cannot see any record in the Discover page . But if I change the

`"grant" : ["src"] to "grant" : ["*"]`

, things are working fine . Can some one make me understand what is the use of Grant field option in Kibana or how to restrict user to a certain field ?

Regards  
Vikas

---

<div class="post-metadata">

### Author: ![colby](https://avatars.discourse-cdn.com/v4/letter/c/d07c76/32.png) [@colby](https://discuss.elastic.co/u/colby)
#### Post date: [September 1, 2017, 6:28pm UTC](https://discuss.elastic.co/t/how-to-implement-field-level-security-with-x-pack/99136/2 "2017-09-01T18:28:03Z")

</div>

Vikas, are you working with sensitive data? Like healthcare data?

---

<div class="post-metadata">

### Author: ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)
#### Post date: [September 4, 2017, 7:07am UTC](https://discuss.elastic.co/t/how-to-implement-field-level-security-with-x-pack/99136/3 "2017-09-04T07:07:48Z")

</div>

Hi Colby,

NO!!, I am working on security data .

Regards  
VG

---

<div class="post-metadata">

### Author: ![vikas\_gopal](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vikas_gopal/32/47661_2.png) [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)
#### Post date: [September 4, 2017, 11:17am UTC](https://discuss.elastic.co/t/how-to-implement-field-level-security-with-x-pack/99136/4 "2017-09-04T11:17:23Z")

</div>

Any input from anyone please ?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 2, 2017, 11:17am UTC](https://discuss.elastic.co/t/how-to-implement-field-level-security-with-x-pack/99136/5 "2017-10-02T11:17:33Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.