# Kibana roles / Errors - warning showing after login **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [May 11, 2021, 4:00pm UTC](https://discuss.elastic.co/t/kibana-roles-errors-warning-showing-after-login/272721 "2021-05-11T16:00:37Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![leal](https://avatars.discourse-cdn.com/v4/letter/l/6de8d8/32.png) [@leal](https://discuss.elastic.co/u/leal)\ **Post date:** [May 11, 2021, 4:00pm UTC](https://discuss.elastic.co/t/kibana-roles-errors-warning-showing-after-login/272721/1 "2021-05-11T16:00:37Z")
We had a need to leave some users of a web application to see specific logs for that app. I have created a role, updated `/etc/elasticsearch/role_mapping.yml`, I've installed filebeat to fetch this data from the source hosts and send it to logstash which then sends it to ES. All is fine. This role allows users to see these specific indices' documents (it's a custom index name). It works. The users have read permissions on these custom index names, they can also read metadata on them. The issue is that whenever I login with a user under this role I get a warning like the one in the attached image. ![error-kibana-01](https://us1.discourse-cdn.com/elastic/original/3X/7/6/7638b3a1ac8bef2211aebb81c54f73840fd832ed.png) I do not know why it's trying to read the `auditbeat*` indices when in reality they do not have access to these indices as per the role's permissions. But, whenever I select the right index pattern from Kibana I can see the data and search on the intended indices' documents without issues. To make this a pleasant experience for my users I would like to know how to avoid this issue. I've also prepared a cheat sheet for them on how to use `curl(1)` to search for data but I do think some of them may chose the Web GUI to do it and while it works I would like a good experience for them while doing so. Thanks. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 12, 2021, 12:21am UTC](https://discuss.elastic.co/t/kibana-roles-errors-warning-showing-after-login/272721/2 "2021-05-12T00:21:19Z")
Welcome to our community! 😃 What's the default index for that space? It might make sense to move this into it's own space which defaults to your custom index pattern. ---
**Author:** ![leal](https://avatars.discourse-cdn.com/v4/letter/l/6de8d8/32.png) [@leal](https://discuss.elastic.co/u/leal)\ **Post date:** [May 12, 2021, 12:14pm UTC](https://discuss.elastic.co/t/kibana-roles-errors-warning-showing-after-login/272721/3 "2021-05-12T12:14:10Z")
Hello @warkolm thank you! I know how to create a space but I do not know how to set the default index pattern per space, any pointers to the docs? ---
**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\ **Post date:** [May 12, 2021, 4:25pm UTC](https://discuss.elastic.co/t/kibana-roles-errors-warning-showing-after-login/272721/4 "2021-05-12T16:25:35Z")
![Screen Shot 2021-05-12 at 9.22.03 AM](https://us1.discourse-cdn.com/elastic/original/3X/1/3/13b59ac9df31ae38a1bb2e35ca43918248e16978.png) The first index pattern you create is automatically designated as the default pattern, but you can set any index pattern as the default. By clicking on the star in the top right you can make any index pattern as the default index pattern. > **[Create an index pattern | Kibana Guide \[7.12\] | Elastic](https://www.elastic.co/guide/en/kibana/current/index-patterns.html#default-index-pattern)** hope this helps Rashmi ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 9, 2021, 4:26pm UTC](https://discuss.elastic.co/t/kibana-roles-errors-warning-showing-after-login/272721/5 "2021-06-09T16:26:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.