# Marvel & rest.action.multi.allow\_explicit\_index: false **URL:** \ **Category:** Elasticsearch\ **Created:** [March 6, 2014, 12:07pm UTC](https://discuss.elastic.co/t/marvel-rest-action-multi-allow-explicit-index-false/16192 "2014-03-06T12:07:25Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Antonios\_Chalkiopoul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/antonios_chalkiopoul/32/1753_2.png) [@Antonios\_Chalkiopoul](https://discuss.elastic.co/u/Antonios_Chalkiopoul)\ **Post date:** [March 6, 2014, 12:07pm UTC](https://discuss.elastic.co/t/marvel-rest-action-multi-allow-explicit-index-false/16192/1 "2014-03-06T12:07:25Z")
To prevent users from overriding the index which has been specified in the URL i set rest.action.multi.allow\_explicit\_index: false in elasticsearch.yml (using es - version 1.0.1) After restarting elasticseach i am getting errors in the logs coming from Marvel java.io.IOException: Server returned HTTP response code: 400 for URL: [http://localhost:9200/\_bulk](http://localhost:9200/_bulk) [2014-03-06 12:05:10,305][ERROR][marvel.agent.exporter] error sending data I'm just guessing that in a clustered environment i can have insecure rest API - in the ES server that marvel will be talking to and a secure rest API in the ES server that the clients will be talking to... Any ideas or experiences with securing ES while having also Marvel for monitoring ?! -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/0bf8c554-5591-48de-a70f-605c0ac10651%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/0bf8c554-5591-48de-a70f-605c0ac10651%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
**Author:** ![Boaz\_Leskes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boaz_leskes/32/723_2.png) [@Boaz\_Leskes](https://discuss.elastic.co/u/Boaz_Leskes)\ **Post date:** [March 9, 2014, 9:40pm UTC](https://discuss.elastic.co/t/marvel-rest-action-multi-allow-explicit-index-false/16192/2 "2014-03-09T21:40:22Z")
Hi Antonios, Marvel uses the rest bulk indexing API to send it's data. It currently uses the standard format where the index is specified on every item in the request. The setting you mention disallows it. I made a note to change this behavior in Marvel as all the items in the body use the same index and so we could move it to the url. Until this is changed, you'd have to indeed disable this setting on the cluster you intend to store marvel data in. Cheers, Boaz On Thursday, March 6, 2014 1:07:25 PM UTC+1, Antonios Chalkiopoulos wrote: > To prevent users from overriding the index which has been specified in > the URL > i set > rest.action.multi.allow\_explicit\_index: false > in elasticsearch.yml (using es - version 1.0.1) > > After restarting elasticseach i am getting errors in the logs coming from > Marvel > > java.io.IOException: Server returned HTTP response code: 400 for URL: > [http://localhost:9200/\_bulk](http://localhost:9200/_bulk) > [2014-03-06 12:05:10,305][ERROR][marvel.agent.exporter] error sending > data > > I'm just guessing that in a clustered environment i can have insecure rest > API - in the ES server that marvel will be talking to > and a secure rest API in the ES server that the clients will be talking > to... > > Any ideas or experiences with securing ES while having also Marvel for > monitoring ?! -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/7e71c4cb-fc36-412c-aea3-98b9fc231efb%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/7e71c4cb-fc36-412c-aea3-98b9fc231efb%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Boaz\_Leskes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boaz_leskes/32/723_2.png) [@Boaz\_Leskes](https://discuss.elastic.co/u/Boaz_Leskes)\ **Post date:** [November 15, 2014, 5:12pm UTC](https://discuss.elastic.co/t/marvel-rest-action-multi-allow-explicit-index-false/16192/3 "2014-11-15T17:12:12Z")
Hi Antonios, It's been a while but I wanted to let you know that this has bbeen fixed and will be available in this marvel release. cheers, Boaz On Sunday, March 9, 2014 10:40:22 PM UTC+1, Boaz Leskes wrote: > Hi Antonios, > > Marvel uses the rest bulk indexing API to send it's data. It currently > uses the standard format where the index is specified on every item in the > request. The setting you mention disallows it. I made a note to change this > behavior in Marvel as all the items in the body use the same index and so > we could move it to the url. > > Until this is changed, you'd have to indeed disable this setting on the > cluster you intend to store marvel data in. > > Cheers, > Boaz > > On Thursday, March 6, 2014 1:07:25 PM UTC+1, Antonios Chalkiopoulos wrote: > > > To prevent users from overriding the index which has been specified in > > the URL > > i set > > rest.action.multi.allow\_explicit\_index: false > > in elasticsearch.yml (using es - version 1.0.1) > > > > After restarting elasticseach i am getting errors in the logs coming from > > Marvel > > > > java.io.IOException: Server returned HTTP response code: 400 for URL: > > [http://localhost:9200/\_bulk](http://localhost:9200/_bulk) > > [2014-03-06 12:05:10,305][ERROR][marvel.agent.exporter] error sending > > data > > > > I'm just guessing that in a clustered environment i can have insecure > > rest API - in the ES server that marvel will be talking to > > and a secure rest API in the ES server that the clients will be talking > > to... > > > > Any ideas or experiences with securing ES while having also Marvel for > > monitoring ?! -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/56aef495-2f9b-4e13-a424-d5343aabc089%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/56aef495-2f9b-4e13-a424-d5343aabc089%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Boaz\_Leskes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/boaz_leskes/32/723_2.png) [@Boaz\_Leskes](https://discuss.elastic.co/u/Boaz_Leskes)\ **Post date:** [December 20, 2014, 8:51am UTC](https://discuss.elastic.co/t/marvel-rest-action-multi-allow-explicit-index-false/16192/4 "2014-12-20T08:51:29Z")
Hi Antonios, A short note that Marvel 1.3.0 was released with this fix. Cheers, Boaz On Saturday, November 15, 2014 6:12:13 PM UTC+1, Boaz Leskes wrote: > Hi Antonios, > > It's been a while but I wanted to let you know that this has bbeen fixed > and will be available in this marvel release. > > cheers, > Boaz > > On Sunday, March 9, 2014 10:40:22 PM UTC+1, Boaz Leskes wrote: > > > Hi Antonios, > > > > Marvel uses the rest bulk indexing API to send it's data. It currently > > uses the standard format where the index is specified on every item in the > > request. The setting you mention disallows it. I made a note to change this > > behavior in Marvel as all the items in the body use the same index and so > > we could move it to the url. > > > > Until this is changed, you'd have to indeed disable this setting on the > > cluster you intend to store marvel data in. > > > > Cheers, > > Boaz > > > > On Thursday, March 6, 2014 1:07:25 PM UTC+1, Antonios Chalkiopoulos wrote: > > > > > To prevent users from overriding the index which has been specified in > > > the URL > > > i set > > > rest.action.multi.allow\_explicit\_index: false > > > in elasticsearch.yml (using es - version 1.0.1) > > > > > > After restarting elasticseach i am getting errors in the logs coming > > > from Marvel > > > > > > java.io.IOException: Server returned HTTP response code: 400 for URL: > > > [http://localhost:9200/\_bulk](http://localhost:9200/_bulk) > > > [2014-03-06 12:05:10,305][ERROR][marvel.agent.exporter] error > > > sending data > > > > > > I'm just guessing that in a clustered environment i can have insecure > > > rest API - in the ES server that marvel will be talking to > > > and a secure rest API in the ES server that the clients will be talking > > > to... > > > > > > Any ideas or experiences with securing ES while having also Marvel for > > > monitoring ?! -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/deafcb52-a633-488a-bffa-2c184ce7418b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/deafcb52-a633-488a-bffa-2c184ce7418b%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:42am UTC](https://discuss.elastic.co/t/marvel-rest-action-multi-allow-explicit-index-false/16192/5 "2017-07-06T00:42:35Z")