# Indices:data/read/search exception

**URL:** <https://discuss.elastic.co/t/indices-data-read-search-exception/64939>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 3, 2016, 7:12pm UTC](https://discuss.elastic.co/t/indices-data-read-search-exception/64939 "2016-11-03T19:12:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [November 3, 2016, 7:12pm UTC](https://discuss.elastic.co/t/indices-data-read-search-exception/64939/1 "2016-11-03T19:12:58Z")

</div>

Hello,

I am getting this in Kibana:

plugin:elasticsearch [security\_exception] action [indices:data/read/search] is unauthorized for user [kibana-server]

XGET /\_shield/user?pretty gives me this  
{  
"kibana-server" : {  
"username" : "kibana-server",  
"roles" : ["kibana4\_server"],  
"full\_name" : null,  
"email" : null,  
"metadata" : { }  
}

in my roles.yml on the ES data nodes, I have the following

# The required permissions for the kibana 4 server

kibana4\_server:  
cluster:  
- monitor  
indices:  
- names: '.kibana\*'  
privileges:  
- all

XGET \_shield/role?pretty gives me this

"kibana4\_server" : {  
"cluster" : ["all"],  
"indices" : [ {  
"names" : ["\*"],  
"privileges" : ["all"]  
} ],  
"run\_as" : ["test"]  
}

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [November 4, 2016, 12:07pm UTC](https://discuss.elastic.co/t/indices-data-read-search-exception/64939/2 "2016-11-04T12:07:16Z")

</div>

The first thing to do is to remove the duplicated roles. The role in the file is being used, but it looks like you want the role in the API to be used? If so, I would remove the role in the roles.yml file on all nodes.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/indices-data-read-search-exception/64939/3 "2017-07-06T13:41:28Z")

</div>