# Index privileges

**URL:** <https://discuss.elastic.co/t/index-privileges/74101>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 6, 2017, 5:31pm UTC](https://discuss.elastic.co/t/index-privileges/74101 "2017-02-06T17:31:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_Campos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_campos/32/11259_2.png) [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Post date:** [February 6, 2017, 5:31pm UTC](https://discuss.elastic.co/t/index-privileges/74101/1 "2017-02-06T17:31:58Z")

</div>

Hi there

I was trying to give access to user with this query.

"{  
"match": {  
"path.raw": {  
"query": "/var/log/top10/customer.log",  
"type": "phrase"  
}  
}  
}"

I would like log in and directly get all info about it "customer.log".

Can you help me?

Greetings

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [February 9, 2017, 8:26pm UTC](https://discuss.elastic.co/t/index-privileges/74101/2 "2017-02-09T20:26:04Z")

</div>

Are you using the Kibana Roles interface?

Here's a screenshot from a test case. We create a role and specify the index `dlstest` in our test case.

We give `read` and `view_index_metadata` privileges which are both required to access that data in Kibana.

And we set the Granted Documents Query to `{"match": {"region": "EAST"}}` where "region" is a field with value of "EAST" in some documents.

We create a user and give the user this "myroleEast" role and "kibana\_user" role.

Then when we go to Discover tab in Kibana we only see those documents.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/d/d7b4012f7dd7b35afe412bca213f3e0ef5e6da3b.png)

How are you giving access to the user with the query? What happens in your case.

Regards,  
Lee

---

<div class="post-metadata">

**Author:** ![Jose\_Campos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_campos/32/11259_2.png) [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Post date:** [February 9, 2017, 9:11pm UTC](https://discuss.elastic.co/t/index-privileges/74101/3 "2017-02-09T21:11:15Z")

</div>

Hi there @LeeDr

Thanks for all. This happens in my case.

This is my indexed document, that contains a file, ccg.log. I would like give access for example, a "test" user with the privileges only "read" all the documents that contains ccg.log

 ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5dced4b0f1e8f096bdadb32465a1681db05bcbc7.png)

When I filter "path" in my dashboard, this shows me.

![](https://us1.discourse-cdn.com/elastic/original/2X/a/a9dc99315a053167df54044d1c5f13fc7f3f1b4f.png)

This is what I want, but with no admin user. This query.

---

<div class="post-metadata">

**Author:** ![LeeDr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leedr/32/9289_2.png) [@LeeDr](https://discuss.elastic.co/u/LeeDr)\
**Post date:** [February 9, 2017, 9:57pm UTC](https://discuss.elastic.co/t/index-privileges/74101/4 "2017-02-09T21:57:22Z")

</div>

Are you saying you want to do this without using the x-pack plugin for security?

---

<div class="post-metadata">

**Author:** ![Jose\_Campos](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jose_campos/32/11259_2.png) [@Jose\_Campos](https://discuss.elastic.co/u/Jose_Campos)\
**Post date:** [February 9, 2017, 10:44pm UTC](https://discuss.elastic.co/t/index-privileges/74101/5 "2017-02-09T22:44:25Z")

</div>

No, using the x-pack.

This querty that you made was my solution ahahhaha

{"match": {"region": "EAST"}}

and the user roles were missing "ingest\_admin and transport\_client".

For example in the case that you showed me " ROLES: myrolesEast, Kibana\_user, Ingest\_admin, transport\_client"

I just added those roles and everything did work.

Can you tell me what "ingest\_admin and transport\_client" works for?

Thanks for all.

Greetings

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 9, 2017, 10:44pm UTC](https://discuss.elastic.co/t/index-privileges/74101/6 "2017-03-09T22:44:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.