# Nothing in the error logs for RBAC
**URL:** https://discuss.elastic.co/t/nothing-in-the-error-logs-for-rbac/218810
**Category:** Elasticsearch
**Created:** [February 11, 2020, 3:57pm UTC](https://discuss.elastic.co/t/nothing-in-the-error-logs-for-rbac/218810 "2020-02-11T15:57:17Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@YvorL](https://discuss.elastic.co/u/YvorL)
#### Post date: [February 11, 2020, 3:57pm UTC](https://discuss.elastic.co/t/nothing-in-the-error-logs-for-rbac/218810/1 "2020-02-11T15:57:17Z")
Hi,
I was setting up a 3rd party application and forgot to extend its role to read a new index. It took me some time (classified) while I realized my mistake. Shouldn't I be able to see the unauthorized request in the logs or I'd need to upgrade to a higher plan in order to see that?
Thanks!
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [February 12, 2020, 6:03am UTC](https://discuss.elastic.co/t/nothing-in-the-error-logs-for-rbac/218810/2 "2020-02-12T06:03:28Z")
You would need to enable [audit logging](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/enable-audit-logging.html). The error would be also visible in the response to the API call you were making.
---
### Author:  [@YvorL](https://discuss.elastic.co/u/YvorL)
#### Post date: [February 12, 2020, 10:25am UTC](https://discuss.elastic.co/t/nothing-in-the-error-logs-for-rbac/218810/3 "2020-02-12T10:25:28Z")
I see. I understand that I can't get everything with a basic account, but since I (thankfully) get RBAC, I'd expect a vague entry which would indicate the source of the issue. As I described it was my mistake not checking the basics but I was like "Hey, the E+L error logs are empty, it has to be something with that app.". Again, I'm happy to have RBAC, just expected something to warn me that I messed up.
Thank you!
P.s.: The app unfortunately didn't handle the response which is a shame too, I found out the issue when I made a curl call with the app's creds and it was clear what I missed during setup:
> {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:data/read/search] is unauthorized for user [XXXXXXX]"}],"type":"security\_exception","reason":"action [indices:data/read/search] is unauthorized for user [XXXXXXX]"},"status":403}
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [February 12, 2020, 10:43am UTC](https://discuss.elastic.co/t/nothing-in-the-error-logs-for-rbac/218810/4 "2020-02-12T10:43:19Z")
We do print this on DEBUG level if you set `logger.org.elasticsearch.xpack.security.authz` to `"DEBUG"`
---
### Author:  [@YvorL](https://discuss.elastic.co/u/YvorL)
#### Post date: [February 12, 2020, 3:55pm UTC](https://discuss.elastic.co/t/nothing-in-the-error-logs-for-rbac/218810/5 "2020-02-12T15:55:40Z")
Thank you!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 11, 2020, 3:55pm UTC](https://discuss.elastic.co/t/nothing-in-the-error-logs-for-rbac/218810/6 "2020-03-11T15:55:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.