# In Kibana Getting \[indices/data/read/msearch\] Even this access is given in Roles.yml file for shield
**URL:** https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [October 7, 2016, 3:40pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504 "2016-10-07T15:40:21Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@balubollam](https://discuss.elastic.co/u/balubollam)
#### Post date: [October 7, 2016, 3:40pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/1 "2016-10-07T15:40:21Z")
Hi Everyone,
I am using
ElasticSerach 2.4
Shield 2.3
Kibana 4.5.4
We have configured shield in roles.yml file in the following way..
developer:
indices:
'dev_tes_,dev_desi_':
privileges:
- indices:admin/mappings/fields/get
- indices:admin/validate/query
- indices:data/read/search
- indices:data/read/msearch
- indices:data/read/field\_stats
- indices:admin/get
query:
term:
dev\_name: something
kibana:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'.kibana\*,kibana-test,kibana-local':
- indices:admin/exists
- indices:admin/mapping/put
- indices:admin/mappings/fields/get
- indices:admin/refresh
- indices:admin/validate/query
- indices:data/read/get
- indices:data/read/mget
- indices:data/read/search
- indices:data/read/msearch
- indices:data/write/delete
- indices:data/write/index
- indices:data/write/update
- indices:admin/create
Created users for the roles:admin,developer,kibana
Assigned the developer role user to the kibana role..
Now in kibana.yml file configured the KIbana role User..
Now when we logged in the user Other than Admin.
..We are getting Security Exception [indicesata/read/msearch] When **there is No data for that Particular Date**
So please Anyone help me Out How To solve This Issue..
Thanks
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [October 10, 2016, 6:46pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/2 "2016-10-10T18:46:01Z")
> [@balubollam](#):
>
> Assigned the developer role user to the kibana role..
I didn't think you could assign one role to another role. Do you mean you assigned the developer and kibana roles to a user?
In your kibana.yml you should have a user with a kibana\_server role which I think is built-in role in your roles.yml. Do you have a kibana\_server role?
Then you have a kibana user (not in the kibana.yml) which has needs some privileges on .kibana index as well as privs on the indexes which contain your data.
Here's a reference;
> **[Using Kibana with Shield | Shield \[2.4\] | Elastic](https://www.elastic.co/guide/en/shield/current/kibana.html)**
Regards,
Lee
---
### Author:  [@balubollam](https://discuss.elastic.co/u/balubollam)
#### Post date: [October 13, 2016, 2:37pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/3 "2016-10-13T14:37:05Z")
Hi Lee,
Thanks For Your reply...
No i mean, I assigned the Particular User Of the Develope role To the Kibana Role...
I created User1 To the Developer Role..
NOw i assigned in this way
esusers roles User1 -a kibana
Hope You got my point...
Yes lee i have kibana\_server....But i have only access to .kibana index in that role.....So shall i give all my indices there also??...Please suggest
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [October 14, 2016, 11:31pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/4 "2016-10-14T23:31:37Z")
On my 4.6.0 Kibana instance I have this kibana server role which is only used in the kibana.yml file;
```auto
kibana4_server:
cluster:
- monitor
indices:
- names: '.kibana*'
privileges:
- all
- names: '.reporting-*'
privileges:
- all
```
and this kibana user role. In this case I have `indices - names: '*'` but that one could be `'dev*'` or whatever you need. And for the indices that contain the data they need `view_index_metadata` and `read`.
But that kibanaUser role also includes `'.kibana*' manage, read, and index` ;
```auto
kibanaUser:
cluster:
- monitor
indices:
- names: '*'
privileges:
- view_index_metadata
- read
- names: '.kibana*'
privileges:
- manage
- read
- index
```
Here's my simple test setup user/roles;
```auto
root@ubuntu32:/usr/share/elasticsearch:> /usr/share/elasticsearch/bin/shield/esusers list
admin : admin
user : kibanaUser
kibana4 : kibana4_server
```
---
### Author:  [@ABFenix](https://discuss.elastic.co/u/ABFenix)
#### Post date: [November 11, 2016, 12:11pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/5 "2016-11-11T12:11:03Z")
Hi everyone.
In my case I need a kibana user role for access to only one alias (named "rfc"). So, I've configured my role in roles.yml in the following way:
analytics\_rfcUser:
cluster:
- monitor
indices:
- names: 'rfc\*'
privileges:
- view\_index\_metadata
- read
- names: '.kibana\*'
privileges:
- manage
- read
- index
Is't similar to "my\_kibana\_user" role that appears in [https://www.elastic.co/guide/en/shield/current/kibana.html](https://www.elastic.co/guide/en/shield/current/kibana.html)
But it doesn't works. I don't know if there's a sintax error or if the problem is that I need to use an alias.
Thanks a lot.
AB
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [November 11, 2016, 2:58pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/6 "2016-11-11T14:58:12Z")
Hi AB,
Could you please tell us which version of Kibana you are using?
I think there was an issue about Kibana not fully supporting index alias names. If `rfc` is an alias for some other index name, could you try using the actual name?
Another tip, if you paste the section of your roles.yml with three backticks ` before and after it it will be formatted in a more readable way;
```auto
like here
privileges
```
Thanks,
Lee
---
### Author:  [@ABFenix](https://discuss.elastic.co/u/ABFenix)
#### Post date: [November 14, 2016, 2:30pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/7 "2016-11-14T14:30:12Z")
Hello Lee.
Thank you so much for your reply.
The versions I'm using are:
```auto
- elasticsearch 2.4.1
- kibana 4.6.1
```
I tried to use an index but I get the same output.
I read the issue related to Kibana and index alias and It seems the problem was solved; so, I'm not sure I'm having the same problem.
Perhaps I need additional privileges or they're the versions we have in our environment... I don't know.
Thanks again.
AB
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [November 14, 2016, 10:32pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/8 "2016-11-14T22:32:59Z")
Hi AB,
Your analytics\_rfcUser role definition looks correct. What exactly happens when you log in as a user with that role?
One thing that can happen is that if there is a default index pattern that the new user doesn't have access to, they may see an error message about that index. But in that case you should be able to click OK on the error and continue.
Lee
---
### Author:  [@ABFenix](https://discuss.elastic.co/u/ABFenix)
#### Post date: [November 15, 2016, 10:24pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/9 "2016-11-15T22:24:24Z")
Hello again...
It worked!!! The problem was, as you thought, the default index pattern. When I click on the error message and select another index pattern to which the user has privileges, kibana returns data correctly...
And it works with aliases too!!! This is great, because I use aliases all the time...
Thank you so much for your help!!!
AB
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [November 15, 2016, 10:44pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/10 "2016-11-15T22:44:01Z")
You're Welcome. Glad I could help!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/in-kibana-getting-indices-data-read-msearch-even-this-access-is-given-in-roles-yml-file-for-shield/62504/11 "2017-07-06T13:41:24Z")