# How we can use RBAC in elasticserach7.1
**URL:** https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [June 11, 2019, 4:27am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086 "2019-06-11T04:27:59Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [June 11, 2019, 4:27am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/1 "2019-06-11T04:27:59Z")
Hello Teamt ,
Currently we are using ELK Version 6.4.4. All things are working fine as expected. We are not using any feature of xpac because we are using basic license.
But few days back elasticsearch7.1 come with free TLS and RBAC on Kibana. So we want to test and use it.
From yesterday i am trying to understand how we can implement RBAC but unable to understand how we can configure it.
Can we follow the below article:
[https://www.elastic.co/guide/en/kibana/7.x/development-security-rbac.html](https://www.elastic.co/guide/en/kibana/7.x/development-security-rbac.html)
Please help me how we can do it so we can start our testing and later can enjoy the new feature of ELK.
Thanks.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 11, 2019, 4:46am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/2 "2019-06-11T04:46:48Z")
Use [https://www.elastic.co/guide/en/kibana/current/development-security-rbac.html](https://www.elastic.co/guide/en/kibana/current/development-security-rbac.html) and [https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html), not the 7.X URL.
Other than that you should be ok
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [June 11, 2019, 4:55am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/3 "2019-06-11T04:55:28Z")
@warkolm, Thank you for your response.
As per below article we need to use Dev tool of kibana to implement it.
[https://www.elastic.co/guide/en/kibana/current/development-security-rbac.html](https://www.elastic.co/guide/en/kibana/current/development-security-rbac.html)
Can we use only single feature of xpac like RBAC alone? Or we need to use the security also if we want to use RBAC?
Please guide me.
Thanks.
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 11, 2019, 5:19am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/4 "2019-06-11T05:19:38Z")
You don't need to use that, you can use the same commands with curl or postman or whatever.
Security is the collection of features, that includes RBAC.
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [June 11, 2019, 8:05am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/5 "2019-06-11T08:05:10Z")
@warkolm,
I have added the below lines in my `elasticserach.yml` file:
```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
```
And set the password for all built in user. Now when i run any query over my elasticsearch i need to pass credential for built in user `elastic` like below:
```auto
curl -XGET -u elastic:admin@123 http://192.168.56.4:9200/
```
But after enabling security in elasticsearch i am not able to login in `kibana dashboard`. I have added the below lines in my `kibana.yml` file which are kibana built in user and password for that user:
```auto
elasticsearch.username: "kibana"
elasticsearch.password: "admin@123"
```
Now i have below question:
1. Can we add the elastic built in user and password in `elasticserach.yml` file? If yes then how?
2. Why i am unable to login in kibana dashboard using old credentials? Is i need to install xpac over kibana also?
3. What will be the changes in logstash and beats after using xpac?
Please guide me.
Thanks.
---
### Author:  [@Balaji](https://discuss.elastic.co/u/Balaji)
#### Post date: [June 11, 2019, 8:44am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/6 "2019-06-11T08:44:30Z")
Hi ,
Did you made changes in Elasticsearch.yml file? If not, then add the below lines only in this file and removed it from Kibana.yml. I couldnt able to test the basic RBAC on v7.1.
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
Thanks.
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [June 11, 2019, 8:54am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/7 "2019-06-11T08:54:14Z")
@Balaji,
i have added the below lines in my `elasticserach.yml`
> [@Balaji](#):
>
> xpack.security.enabled: true
> xpack.security.transport.ssl.enabled: true
> [@Balaji](#):
>
> removed it from Kibana.yml.
i didn't add these lines in `kibana.yml` file. Only built in user i.e kibana and password is added in `kibana.yml` file:
> [@Tek\_Chand](#):
>
> elasticsearch.username: "kibana"
> elasticsearch.password: "admin@123"
Please suggest what changes are required.
Thanks.
---
### Author:  [@Balaji](https://discuss.elastic.co/u/Balaji)
#### Post date: [June 11, 2019, 9:08am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/8 "2019-06-11T09:08:03Z")
Did you run the below command after making changes to Elasticsearch.yml to create kibana & other user credentials
./bin/elasticsearch-setup-passwords interactive
If so, what is the error that you are getting in the log files?
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [June 11, 2019, 9:51am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/9 "2019-06-11T09:51:28Z")
@Balaji,
> [@Balaji](#):
>
> Did you run the below command after making changes to Elasticsearch.yml to create kibana & other user credentials
>
> ./bin/elasticsearch-setup-passwords interactive
Yes..i have run the above command and it was run successfully and i have set the password for all built in users using above command.
> [@Tek\_Chand](#):
>
> I have added the below lines in my `elasticserach.yml` file:
>
> ```auto
> xpack.security.enabled: true
> xpack.security.transport.ssl.enabled: true
>
> ```
>
> And set the password for all built in user. Now when i run any query over my elasticsearch i need to pass credential for built in user `elastic` like below:
>
> ```auto
> curl -XGET -u elastic:admin@123 http://192.168.56.4:9200/
>
> ```
>
> But after enabling security in elasticsearch i am not able to login in `kibana dashboard` . I have added the below lines in my `kibana.yml` file which are kibana built in user and password for that user:
>
> ```auto
> elasticsearch.username: "kibana"
> elasticsearch.password: "admin@123"
>
> ```
After the above configuration i am getting the below error when i am trying to access kibana dashboard:
```auto
message":"Authentication attempt failed: [security_exception] unable to authenticate user [tek] for REST request [/_security/_authenticate], with { header={ WWW-Authenticate=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } }"}
```
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [June 11, 2019, 11:05am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/10 "2019-06-11T11:05:20Z")
@warkolm, @Balaji,
I am able to access the kibana dashboard. But i am confused why i am able to login in kibana dashboard using elastic built in user and credential instead of user created earlier which is used before xpack enble?
But now i am not getting logs on Kibana dashboard. Can you please help me what changes are required at logstash end?
Its seems that logstash is not sending logs to elasticsearch after enabling xpack at elasticserach.
Because i am able to see the old logs on kibana. It means kibana able to communicate with elasticserach.
Thanks.
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [June 11, 2019, 1:20pm UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/11 "2019-06-11T13:20:30Z")
> [@Tek\_Chand](#):
>
> I am able to access the kibana dashboard. But i am confused why i am able to login in kibana dashboard using elastic built in user and credential instead of user created earlier which is used before xpack enble?
Log in with the `elastic` user works, because you have set the password for the `elastic` user with the `elasticsearch-setup-passwords` command and you're using the correct password. Expected behavior. Now, what is this "user created earlier which is used before xpack enble" and how was it created ?
> [@Tek\_Chand](#):
>
> But now i am not getting logs on Kibana dashboard. Can you please help me what changes are required at logstash end?
We can only suggest changes if you share your current configuration with us. If we don't know what you use now, we can't know what you need to change 🙂 Assuming that you are using the elasticsearch output plugin in Logstash, please read through our [documentation](https://www.elastic.co/guide/en/logstash/7.1/ls-security.html) where we explain what needs to be configured. If after reading that and performing the necessary configuration changes, you still have issues, we'll be glad to help further, but do take the time to read through the docs, I'm sure you'll find it enlightening and really helpful for your understanding.
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [June 12, 2019, 4:42am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/12 "2019-06-12T04:42:13Z")
@ikakavas, Thank you for your response.
Below are the changes and configuration which is done by us:
We have added the below 2 line in `elasticsearch.yml` file:
```auto
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
```
And set the password for all built in user. Now when we are trying to query our elasticsearch we need to pass built in user and password then its working. As shown below:
```auto
curl -XGET -u elastic:admin@123 http://192.168.56.4:9200/
```
We have added the below 2 line in our `kibana.yml` file:
```auto
elasticsearch.username: "kibana"
elasticsearch.password: "admin@123"
```
And now we are able to access the kibana dashboard using username `elastic` and its password. We are able to see security feature on dashboard and able to create new user also using `users` and able to login using that user.
We are able to see the old logs also on kibana dashboard.
But now we are facing issue that new logs are not reaching over kibana dashboard. Its seems that logstash is not sending logs to elasticsearch. We have made the below changes at logstash:
Added the below 2 lines in `logstash.yml`
```auto
xpack.monitoring.elasticsearch.username: "logstash_internal"
xpack.monitoring.elasticsearch.password: "admin@123"
```
Below is my logstash configuration file
```auto
input {
beats {
port => 5044
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
add_field => ["received_at", "%{@timestamp}"]
add_field => ["received_from", "%{host}"]
}
syslog_pri { }
date {
match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
}
}
}
output {
elasticsearch {
hosts => ["192.168.56.4:9200"]
user => "logstash_internal"
password => "admin@123"
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
```
When i am restarting the logstash service getting below error log:
```auto
[2019-06-11T17:52:37,338][WARN][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://logstash_internal:xxxxxx@192.168.56.4:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '401' contacting Elasticsearch at URL 'http://192.168.56.4:9200/'"}
[2019-06-11T17:52:38,307][WARN][logstash.outputs.elasticsearch] Error while performing sniffing {:error_message=>"Got response code '401' contacting Elasticsearch at URL 'http://192.168.56.4:9200/_nodes/http'", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadResponseCodeError", :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:80:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in `perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:278:in `block in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:373:in `with_connection'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:277:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:164:in `check_sniff'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:157:in `sniff!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:146:in `block in start_sniffer'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:128:in `until_stopped'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.1.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:144:in `block in start_sniffer'"]}
```
Can you please help me whats mistake i am doing here?
Thanks.
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [June 12, 2019, 5:25am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/13 "2019-06-12T05:25:39Z")
Please read the documentation that I've shared with you already, everything you ask for is written there in detail in section " Configuring Logstash to use Basic Authentication"
---
### Author:  [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)
#### Post date: [June 12, 2019, 11:10am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/14 "2019-06-12T11:10:06Z")
@ikakavas, Thank you for your guidance. After following the documentation my problem is fixed.
I was making mistake i.e logstash\_write role and logstash\_internal user were not available on kibana. After following the documentation i created it and everything become fine.
Thanks.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 10, 2019, 11:10am UTC](https://discuss.elastic.co/t/how-we-can-use-rbac-in-elasticserach7-1/185086/15 "2019-07-10T11:10:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.