Kibana Discover Filter "There aren't any options available"

[WookWook]

Hi,

I created a new role to seperate access to see only filebeat logs from specific Openshift namespaces. So far so good. The user with the role can only see logs from the granted namespaces.

Granted Kibana privileges

If I now try to use "Discover", the filter it is not automatically showing available options. I can manually write a value and the filtering is working properly. Using the standard elastic user I see all the available options.

What permission or anything else do I miss? While troubleshooting I granted temporary"index permission 'all'", all Kibana privileges and Cluster privileges "all". Made no difference.

Regards,
Marius

[jsanz (Jorge Sanz)]

I'm sorry I could not reproduce on 7.13.4.

I've created a test role with permissions to see only a fraction of the kibana flights sample dataset and use the Discover app

---

---

Now when logging with a test user with just that role I can access discover and use the filters and search bar

Can you try with the sample dataset to see if there's anything differnt?

[WookWook]

Hi,

thank you for your help!

Our ECK is running version 7.15.0

I added the same sample data. Created the same role like you. Created a new user. Not the expected behaviour.

[jsanz (Jorge Sanz)]

I run again the same test on 7.15 and I could again make it work.

Have you checked the browser console for request that may be failing to you? I'm not an expert on Discover but I see this request that retrieves metadata of the index pattern

$yourHost/api/index_patterns/_fields_for_wildcard?pattern=kibana_sample_data_flights&meta_fields=_source&meta_fields=_id&meta_fields=_type&meta_fields=_index&meta_fields=_score

that returns an array of fields metatata

let us know if this helps to understand what may be going on here

[WookWook]

Checked it with both users (elastic and testuser). Console looks good. Same expected result in the console, but it is not showing up in the testuser UI. Checked it on Firefox and Chrome.

User: elastic

User: testuser

That is annoying

Regards,
Marius