# Index privilege syntax : all indices except one **URL:** \ **Category:** Kibana\ **Created:** [February 26, 2020, 12:33pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041 "2020-02-26T12:33:19Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![antoineozenne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoineozenne/32/63365_2.png) [@antoineozenne](https://discuss.elastic.co/u/antoineozenne)\ **Post date:** [February 26, 2020, 12:33pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/1 "2020-02-26T12:33:20Z")
Hello, I want grant my new user read only privilege on all indices except one. I don't understand how I can write the query in KQL (I don't use Lucene) : ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/2/028cc905d745ec78df93be0017eb4fe7f082efdb.png) Is it possible ? How ? ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [February 26, 2020, 6:24pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/2 "2020-02-26T18:24:02Z")
@antoineozenne Which version of the Elastic stack are you running? A role can have multiple Index privileges. Simply create a 'read' privilege on `*` and create an additional index priv for the specific index. ---
**Author:** ![antoineozenne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoineozenne/32/63365_2.png) [@antoineozenne](https://discuss.elastic.co/u/antoineozenne)\ **Post date:** [February 26, 2020, 6:42pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/3 "2020-02-26T18:42:47Z")
@mattkime It's Kibana 7.6. So if I have a read privilege on \*, I can negate it on specific index ? What is the privilege to apply on this specific index ? ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [February 27, 2020, 3:29pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/4 "2020-02-27T15:29:55Z")
I hope this is helpful - ![Screen Shot 2020-02-27 at 9.28.53 AM](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aa7f5b1c8b6c8170b6ccf4af4052d3c76cf3869d.png) ---
**Author:** ![antoineozenne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoineozenne/32/63365_2.png) [@antoineozenne](https://discuss.elastic.co/u/antoineozenne)\ **Post date:** [February 27, 2020, 3:39pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/5 "2020-02-27T15:39:34Z")
Thanks, but I don't want give all privileges to a specific indices et read privilege to others. I want give read privileges to all indices except one. This one must not be accessible by my user. ---
**Author:** ![mattkime](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattkime/32/43522_2.png) [@mattkime](https://discuss.elastic.co/u/mattkime)\ **Post date:** [February 27, 2020, 11:23pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/6 "2020-02-27T23:23:24Z")
try `/~(indexname)/` - matches all indices except for the named index ---
**Author:** ![antoineozenne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoineozenne/32/63365_2.png) [@antoineozenne](https://discuss.elastic.co/u/antoineozenne)\ **Post date:** [March 4, 2020, 12:00pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/7 "2020-03-04T12:00:37Z")
This doesn't work, my user have read privileges on all indices. This expression is Lucene, and I search the KQL equivalent. I tested with `/~(prefix-kube-system-*)/`. ---
**Author:** ![antoineozenne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoineozenne/32/63365_2.png) [@antoineozenne](https://discuss.elastic.co/u/antoineozenne)\ **Post date:** [March 4, 2020, 12:30pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/8 "2020-03-04T12:30:28Z")
I also tried index pattern like `prefix-*,-prefix-kube-system-*`, but this doesn't work, my user have again read privileges on all indices. ---
**Author:** ![antoineozenne](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antoineozenne/32/63365_2.png) [@antoineozenne](https://discuss.elastic.co/u/antoineozenne)\ **Post date:** [March 4, 2020, 4:43pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/9 "2020-03-04T16:43:20Z")
Ok, it seems I can use Lucene regexp in this field. So I found the solution : `/prefix-@&~(prefix-kube-system-@)/`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 1, 2020, 4:45pm UTC](https://discuss.elastic.co/t/index-privilege-syntax-all-indices-except-one/221041/10 "2020-04-01T16:45:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.