# I have dashboard i want to hide the extra fields from being accessed from anonymous user **URL:** \ **Category:** Elasticsearch\ **Created:** [April 25, 2024, 2:17pm UTC](https://discuss.elastic.co/t/i-have-dashboard-i-want-to-hide-the-extra-fields-from-being-accessed-from-anonymous-user/358224 "2024-04-25T14:17:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![kishorkumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorkumar/32/132930_2.png) [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Post date:** [April 25, 2024, 2:17pm UTC](https://discuss.elastic.co/t/i-have-dashboard-i-want-to-hide-the-extra-fields-from-being-accessed-from-anonymous-user/358224/1 "2024-04-25T14:17:30Z")
i want to hide the extra fields that are showing to anonymous user, i want him to show only the fields that are used in the dashbaoard other then that hide the fileds. i have added the fields that i wanted to show in the Elasticsearch grand access to specific fields roles \> anonymous \> Elasticsearch \> Index privileges \> Grant access to specific fields ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a059d2105285d11968c702353cf0a32be77693b.png) but when i visit the public url of my dashboard i can see the fields in the filters. ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9cd1b87e45f4cfe7e88aa5b32429177b6a1bdb13.png) any one can guide how do i achieve that ? ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [April 30, 2024, 12:53pm UTC](https://discuss.elastic.co/t/i-have-dashboard-i-want-to-hide-the-extra-fields-from-being-accessed-from-anonymous-user/358224/2 "2024-04-30T12:53:09Z")
That should work, I tested on the Kibana Flights dataset to grant access to only a few fields on the role that is given to the anonymous user ![2024-04-30_14-46](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74a6560ef400edd58e2b668779ff8a5d471afbe0.png) And the sample dashboard on the public space that role is granted access broke as expected ![2024-04-30_14-46_1](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b54209254aff937572fb226ec60fb047f11ffb28.png) My kibana settings are as described in the [anonymous documentation](https://www.elastic.co/guide/en/kibana/current/kibana-authentication.html#anonymous-authentication) ```yaml xpack.security.authc.providers: anonymous.anonymous1: order: 0 credentials: username: public_user password: public_user_password_something basic.basic1: order: 1 ``` Where my `public_user` (not the actual name) has just the `public` role that grants access to a specific Kibana space and certain indices. ---
**Author:** ![kishorkumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorkumar/32/132930_2.png) [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Post date:** [April 30, 2024, 7:17pm UTC](https://discuss.elastic.co/t/i-have-dashboard-i-want-to-hide-the-extra-fields-from-being-accessed-from-anonymous-user/358224/3 "2024-04-30T19:17:55Z")
i also used the same privilege's and settings in same way the documentations told to ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bf6d41dab39957019bc3ae6fc48202bd15d6900b.png) so after applying that i still see the same fields in my dashboard filter ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/a/cacbdc4ec561700b175d4fd8911a435464512798.png) ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [May 2, 2024, 9:11am UTC](https://discuss.elastic.co/t/i-have-dashboard-i-want-to-hide-the-extra-fields-from-being-accessed-from-anonymous-user/358224/4 "2024-05-02T09:11:11Z")
Privileges are combined as described in the [Field Security docs](https://www.elastic.co/guide/en/elasticsearch/reference/8.13/field-level-security.html): > When a user has several roles that specify field level permissions, the resulting field level permissions per data stream or index are the union of the individual role permissions. and in the [guide](https://www.elastic.co/guide/en/elasticsearch/reference/8.13/field-and-document-access-control.html): > ... Document level security takes into account each role held by the user and combines each document level security query for a given data stream or index with an "OR". ... So, you'd need to remove the `staging*` index from the first rule for the second take effect. ---
**Author:** ![kishorkumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kishorkumar/32/132930_2.png) [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Post date:** [May 2, 2024, 2:05pm UTC](https://discuss.elastic.co/t/i-have-dashboard-i-want-to-hide-the-extra-fields-from-being-accessed-from-anonymous-user/358224/5 "2024-05-02T14:05:15Z")
but i am not using that role for one i am using it for multiple dashbards and they all come from different index patterns. in that sense i have to create multiple roles ? for anonymous1 user for earch index to hide the fields. ---
**Author:** ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)\ **Post date:** [May 2, 2024, 2:31pm UTC](https://discuss.elastic.co/t/i-have-dashboard-i-want-to-hide-the-extra-fields-from-being-accessed-from-anonymous-user/358224/6 "2024-05-02T14:31:53Z")
As far as I understand this, having multiple roles or a single role with multiple rules is the same. Elasticsearch will combine all those rules, so if you have more than one that affects `staging*`, they will be unioned, and the fields will pass with the less restrictive rule. Note how those rules have no order at all in the Kibana UI. I'm going to transfer this post to the Elasticsearch forum since your fundamental problem is how Elasticsearch deals with field security, and Kibana is working as expected.