Index privilege syntax : all indices except one

[antoineozenne]

Hello,

I want grant my new user read only privilege on all indices except one. I don't understand how I can write the query in KQL (I don't use Lucene) :

Is it possible ? How ?

[mattkime (Matthew Kime)]

@antoineozenne

Which version of the Elastic stack are you running?

A role can have multiple Index privileges. Simply create a 'read' privilege on * and create an additional index priv for the specific index.

[antoineozenne]

@mattkime

It's Kibana 7.6. So if I have a read privilege on *, I can negate it on specific index ? What is the privilege to apply on this specific index ?

[mattkime (Matthew Kime)]

I hope this is helpful -

[antoineozenne]

Thanks, but I don't want give all privileges to a specific indices et read privilege to others. I want give read privileges to all indices except one. This one must not be accessible by my user.

[mattkime (Matthew Kime)]

try /~(indexname)/ - matches all indices except for the named index

[antoineozenne]

This doesn't work, my user have read privileges on all indices. This expression is Lucene, and I search the KQL equivalent. I tested with /~(prefix-kube-system-*)/.

[antoineozenne]

I also tried index pattern like prefix-*,-prefix-kube-system-*, but this doesn't work, my user have again read privileges on all indices.

[antoineozenne]

Ok, it seems I can use Lucene regexp in this field. So I found the solution : /prefix-@&~(prefix-kube-system-@)/.