# Kibana 403 'Unable to update UI setting' Error while searching on multi-match index pattern

**URL:** https://discuss.elastic.co/t/kibana-403-unable-to-update-ui-setting-error-while-searching-on-multi-match-index-pattern/235158
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [June 1, 2020, 12:03pm UTC](https://discuss.elastic.co/t/kibana-403-unable-to-update-ui-setting-error-while-searching-on-multi-match-index-pattern/235158 "2020-06-01T12:03:31Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![devops\_guy1](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@devops\_guy1](https://discuss.elastic.co/u/devops_guy1)
#### Post date: [June 1, 2020, 12:03pm UTC](https://discuss.elastic.co/t/kibana-403-unable-to-update-ui-setting-error-while-searching-on-multi-match-index-pattern/235158/1 "2020-06-01T12:03:31Z")

</div>

Hi,

I am trying to simulate a multi-tenancy Kibana setup with multiple roles and role mappings, and running into issues with Kibana making strange HTTP calls to itself (just like in this page [Unable to update UI setting Request failed with status code: 403](https://discuss.elastic.co/t/unable-to-update-ui-setting-request-failed-with-status-code-403/201409)) while attempting to use certain index patterns.

**My Setup:**

- Running RPM installations of Elasticsearch and Kibana 7.6.1 on the same VM

- 2 Elasticsearch Roles which give Read permissions to indices matching `"prefix-service1-*"` and `"prefix-service2-*"` respectively.

- 2 indices named `prefix-service1-2020-06-01` and `prefix-service2-2020-06-01`

- 3 index patterns `"prefix-*"`, `"prefix-service1-*"`, and `"prefix-service2-*"`

- A user that can authenticate/log in to Kibana, with both roles assigned successfully.

* * *

**The Issue:**  
when querying from the `Discover` page, with one of the more specific index patterns (`"prefix-service1-*"` for example) documents from the appropriate index show up just fine.  
But when using the more "generic" index pattern (`"prefix-*"`) that matches multiple indices:

1. only documents from `prefix-service1-2020-06-01` are displayed

2. An error pops up on the screen saying:

3. Using the chrome developer console I can see this happens right when an API call is made to http://\<kibana\_host\>:5601/s/\<space\_name\>/api/kibana/settings with a payload of:

```auto
{"changes" : {"defaultIndex":" ********-**** - ****-**** - ************"}}

```

(where "\*"s are a mix of either lowercase chars and numbers)

* * *

I would greatly appreciate any advice or instruction on how to get the "general" index pattern to show documents from all matching indices, and resolve the error/bad API call

---

<div class="post-metadata">

### Author: ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)
#### Post date: [June 4, 2020, 9:04am UTC](https://discuss.elastic.co/t/kibana-403-unable-to-update-ui-setting-error-while-searching-on-multi-match-index-pattern/235158/2 "2020-06-04T09:04:42Z")

</div>

Hi @devops_guy1  
There can be two main issue that are causing this 403 error:

- you don't have a default index-pattern configured
- this role doesn't have access to the configured default index-pattern

Please check a default index-pattern is available, or configure one if not.  
Please also subscribe to the updates on this PR that should fix this issue: [https://github.com/elastic/kibana/pull/54122](https://github.com/elastic/kibana/pull/54122)

---

<div class="post-metadata">

### Author: ![devops\_guy1](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@devops\_guy1](https://discuss.elastic.co/u/devops_guy1)
#### Post date: [June 7, 2020, 2:03pm UTC](https://discuss.elastic.co/t/kibana-403-unable-to-update-ui-setting-error-while-searching-on-multi-match-index-pattern/235158/3 "2020-06-07T14:03:49Z")

</div>

Thanks for taking the time to answer @markov00,

Looking at the reproduction steps on the issue you sent, it looks to be pretty much my use case. I'll be sure to follow up, hope a fix makes it into a release soon... 😄

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2020, 2:03pm UTC](https://discuss.elastic.co/t/kibana-403-unable-to-update-ui-setting-error-while-searching-on-multi-match-index-pattern/235158/4 "2020-07-05T14:03:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.