# Limit message visibility for Kibana users based on message fields

**URL:** <https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790>\
**Category:** Kibana\
**Tags:** docker\
**Created:** [July 28, 2021, 4:25am UTC](https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790 "2021-07-28T04:25:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![beckfoot](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@beckfoot](https://discuss.elastic.co/u/beckfoot)\
**Post date:** [July 28, 2021, 4:25am UTC](https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790/1 "2021-07-28T04:25:29Z")

</div>

Hi everyone. I'm new to the Elastic stack, and I'm trying to find out the best approach for this problem:

I'm trying to set message (event) visibility per user in Kibana in order to display only a subset of messages within one index to a certain user.

In short, the setup that I'm testing looks like this:

- I'm using the official docker containers for elasticsearch, logstash and kibana, with `xpack.security.enabled: true` in elasticsearch settings.
- I have a logstash pipeline that gets messages from RabbitMQ (JSON), and outputs them to elasticsearch. All messages are sent to a single index.
- I have a limited number of producers and consumers of messages.
- The messages have `producer` and `consumer` fields.

I would like to achieve this:

- create the same users / roles in Kibana, e.g.`producer1`, `consumer2`.
- display only those messages to user, that are issued by them (for producers) or addressed to them (for consumers).

Generally speaking, I just want to limit message visibility to Kibana users based on specific message fields.

I believe, I could filter messages in Logstash, and output them to different indices, but that would mean having separate indices per each user, and I'm not sure that this optimal.

I tried to see if I can achieve it using dashboards within spaces, but I'm not sure how. If user has access to certain index, then they are able to see all messages.

What would be the best way to solve this? I would appreciate any help.

---

<div class="post-metadata">

**Author:** ![Dzmitry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dzmitry/32/65026_2.png) [@Dzmitry](https://discuss.elastic.co/u/Dzmitry)\
**Post date:** [July 30, 2021, 12:08pm UTC](https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790/2 "2021-07-30T12:08:15Z")

</div>

Hi @beckfoot ,

I think you can try [Document Level security](https://www.elastic.co/guide/en/elasticsearch/reference/current/document-level-security.html) for this purpose, just check if it is supported by your stack version.

Something like this:

```auto
POST _security/role/producer1_role
{
  "indices": [
    {
      "names": ["events-*"],
      "privileges": ["read"],
      "query": {
        "match": {
          "producer": "producer1"
        }
      }
    }
  ]
}

```

Regards, Dima

---

<div class="post-metadata">

**Author:** ![beckfoot](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@beckfoot](https://discuss.elastic.co/u/beckfoot)\
**Post date:** [July 31, 2021, 6:51am UTC](https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790/3 "2021-07-31T06:51:15Z")

</div>

Thank you @Dzmitry, I have already tried to configure it like that since the original post, but unfortunately, as I'm using the free version of Elasticsearch, I get this error: "current license is non-compliant for [field and document level security]".  
Are there any other options for me? Would solving it through creation of many different indices be a less resource-efficient?

---

<div class="post-metadata">

**Author:** ![Dzmitry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dzmitry/32/65026_2.png) [@Dzmitry](https://discuss.elastic.co/u/Dzmitry)\
**Post date:** [August 1, 2021, 8:56am UTC](https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790/4 "2021-08-01T08:56:32Z")

</div>

Hi @beckfoot ,

If you don't have an option to upgrade license, you are quite limited with options.  
Having multiple indexes sounds like a forced complication, but it is an option.

Regards, Dima

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 29, 2021, 8:56am UTC](https://discuss.elastic.co/t/limit-message-visibility-for-kibana-users-based-on-message-fields/279790/5 "2021-08-29T08:56:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.