# Problems with role based access: x\_content\_parse\_exception

**URL:** <https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796>\
**Category:** Elasticsearch\
**Created:** [September 17, 2018, 9:14am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796 "2018-09-17T09:14:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ea1987](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ea1987/32/51356_2.png) [@ea1987](https://discuss.elastic.co/u/ea1987)\
**Post date:** [September 17, 2018, 9:14am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796/1 "2018-09-17T09:14:24Z")

</div>

Hi guys,  
I'm facing a strange problem with role based access control. Here is my use case:

INDEX DEFINITION

{  
"invoices\_status" : {  
"aliases" : { },  
"mappings" : {  
"status" : {  
"properties" : {  
"company" : {  
"type" : "text"  
},  
"error\_type" : {  
"type" : "text"  
},  
"invoice\_id" : {  
"type" : "text"  
}  
}  
}  
},  
"settings" : {  
"index" : {  
"creation\_date" : "1536588960795",  
"number\_of\_shards" : "5",  
"number\_of\_replicas" : "1",  
"uuid" : "ocN\_Tl79SOqW6U7x3X8ONA",  
"version" : {  
"created" : "6040099"  
},  
"provided\_name" : "invoices\_status"  
}  
}  
}  
}

BRIEF LIST OF INSERTED DOCUMENTS

- company: company\_1 invoice\_id: company\_1\_22222 error\_type: business \_id: 2 \_type: status \_index: invoices\_status \_score: 1
- company: company\_1 invoice\_id: company\_1\_44444 error\_type: technical \_id: 4 \_type: status \_index: invoices\_status \_score: 1
- company: company\_1 invoice\_id: company\_1\_22222 error\_type: business \_id: 1 \_type: status \_index: invoices\_status \_score: 1
- company: company\_2 invoice\_id: company\_2\_33333 error\_type: business \_id: 3 \_type: status \_index: invoices\_status \_score: 1

ROLE DEFINITION  
curl --user elastic:elastic -X GET "localhost:9200/\_xpack/security/role/bus\_company1\_invoice\_status?pretty"  
{  
"bus\_company1\_invoice\_status" : {  
"cluster" : [],  
"indices" : [  
{  
"names" : [  
"invoices\_status"  
],  
"privileges" : [  
"all"  
],  
"field\_security" : {  
"grant" : [  
"_"  
]  
},  
"query" : ""must": [{"match": {"company": "company\_1"}},{"match": {"error\_type": "business"}}]"  
}  
],  
"applications" : [  
{  
"application" : "kibana-.kibana",  
"privileges" : [  
"all"  
],  
"resources" : [  
"_"  
]  
}  
],  
"run\_as" : [],  
"metadata" : { },  
"transient\_metadata" : {  
"enabled" : true  
}  
}  
}

EXPECTED BEHAVIOUR

I expect that when I query for all documents using a bus\_company1\_invoice\_status user, only documents that have company: company\_1 and error\_type: business will be returned. So, basically, only the following:

- \_id: 1
- \_id: 2

The query definition works fine:

curl --user elastic:elastic -X GET "localhost:9200/invoices\_status/status/\_search" -H 'Content-Type: application/json' -d'  
{  
"query": {  
"bool": {  
"must": [  
{ "match": { "company": "company\_1" }},  
{ "match": { "error\_type": "business" }}  
]  
}  
}  
}  
'

{"took":3,"timed\_out":false,"\_shards":{"total":5,"successful":5,"skipped":0,"failed":0},"hits":{"total":2,"max\_score":0.87546873,"hits":[{"\_index":"invoices\_status","\_type":"status","\_id":"2","\_score":0.87546873,"\_source":  
{  
"company": "company\_1",  
"invoice\_id": "company\_1\_22222",  
"error\_type": "business"  
}  
},{"\_index":"invoices\_status","\_type":"status","\_id":"1","\_score":0.5753642,"\_source":  
{  
"company": "company\_1",  
"invoice\_id": "company\_1\_22222",  
"error\_type": "business"  
}  
}]}}[

ACTUAL BEHAVIOUR

curl --user bus\_company1\_invoice\_status:\*\*\*\*\*\* -XGET 'localhost:9200/invoices\_status/\_search?pretty' -H 'Content-Type: application/json' -d'  
{  
"size": 10000,  
"query": {  
"match\_all": {}  
}  
}

{  
"error" : {  
"root\_cause" : [  
{  
"type" : "x\_content\_parse\_exception",  
"reason" : "Failed to derive xcontent"  
}  
],  
"type" : "search\_phase\_execution\_exception",  
"reason" : "all shards failed",  
"phase" : "query",  
"grouped" : true,  
"failed\_shards" : [  
{  
"shard" : 0,  
"index" : "invoices\_status",  
"node" : "V7dQrUk-RhO\_GgWpZ5H8zw",  
"reason" : {  
"type" : "x\_content\_parse\_exception",  
"reason" : "Failed to derive xcontent"  
}  
}  
],  
"caused\_by" : {  
"type" : "x\_content\_parse\_exception",  
"reason" : "Failed to derive xcontent",  
"caused\_by" : {  
"type" : "x\_content\_parse\_exception",  
"reason" : "Failed to derive xcontent"  
}  
}  
},  
"status" : 400  
}

'

Instead, documents are returned correctly if the search is done using the "elastic" user. What's wrong in it?  
Thanks,

Andrea

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [September 17, 2018, 9:57am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796/2 "2018-09-17T09:57:32Z")

</div>

> [@ea1987](#):
>
> "query" : ""must": [{"match": {"company": "company\_1"}},{"match": {"error\_type": "business"}}]"

There seems to be an issue with the query definition here. Please try with

```auto
"query" : "{\"must\": [{\"match\": {\"company\": \"company_1\"}},{\"match\": {\"error_type\": \"business\"}}]}"

```

---

<div class="post-metadata">

**Author:** ![ea1987](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ea1987/32/51356_2.png) [@ea1987](https://discuss.elastic.co/u/ea1987)\
**Post date:** [September 17, 2018, 10:14am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796/3 "2018-09-17T10:14:04Z")

</div>

> [@ikakavas](#):
>
> "query" : "{"must": [{"match": {"company": "company\_1"}},{"match": {"error\_type": "business"}}]}"

Thank you for your suggestion. Basically you added a pair of braces, but it seems not to work. Here it is exception detail provided by Kibana gui

> Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"x\_content\_parse\_exception","reason":"Failed to derive xcontent"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"query","grouped":true,"failed\_shards":[{"shard":0,"index":"invoices\_status","node":"V7dQrUk-RhO\_GgWpZ5H8zw","reason":{"type":"x\_content\_parse\_exception","reason":"Failed to derive xcontent"}}],"caused\_by":{"type":"x\_content\_parse\_exception","reason":"Failed to derive xcontent","caused\_by":{"type":"x\_content\_parse\_exception","reason":"Failed to derive xcontent"}}},"status":400}  
> KbnError@[http://localhost:5601/bundles/commons.bundle.js:3:8333](http://localhost:5601/bundles/commons.bundle.js:3:8333)  
> RequestFailure@[http://localhost:5601/bundles/commons.bundle.js:3:8736](http://localhost:5601/bundles/commons.bundle.js:3:8736)  
> callResponseHandlers/\<@[http://localhost:5601/bundles/commons.bundle.js:3:1094604](http://localhost:5601/bundles/commons.bundle.js:3:1094604)  
> Promise.try@[http://localhost:5601/bundles/commons.bundle.js:3:807109](http://localhost:5601/bundles/commons.bundle.js:3:807109)  
> Promise.map/\<@[http://localhost:5601/bundles/commons.bundle.js:3:806472](http://localhost:5601/bundles/commons.bundle.js:3:806472)  
> Promise.map@[http://localhost:5601/bundles/commons.bundle.js:3:806437](http://localhost:5601/bundles/commons.bundle.js:3:806437)  
> callResponseHandlers@[http://localhost:5601/bundles/commons.bundle.js:3:1093955](http://localhost:5601/bundles/commons.bundle.js:3:1093955)  
> fetchSearchResults/\<@[http://localhost:5601/bundles/commons.bundle.js:3:1079928](http://localhost:5601/bundles/commons.bundle.js:3:1079928)  
> processQueue@[http://localhost:5601/bundles/vendors.bundle.js:197:199684](http://localhost:5601/bundles/vendors.bundle.js:197:199684)  
> scheduleProcessQueue/\<@[http://localhost:5601/bundles/vendors.bundle.js:197:200647](http://localhost:5601/bundles/vendors.bundle.js:197:200647)  
> $RootScopeProvider/this.$get\</Scope.prototype.$digest@[http://localhost:5601/bundles/vendors.bundle.js:197:210409](http://localhost:5601/bundles/vendors.bundle.js:197:210409)  
> $RootScopeProvider/this.$get\</Scope.prototype.$evalAsync/\<@[http://localhost:5601/bundles/vendors.bundle.js:197:212930](http://localhost:5601/bundles/vendors.bundle.js:197:212930)  
> completeOutstandingRequest@[http://localhost:5601/bundles/vendors.bundle.js:197:64421](http://localhost:5601/bundles/vendors.bundle.js:197:64421)  
> Browser/self.defer/timeoutId\<@[http://localhost:5601/bundles/vendors.bundle.js:197:67265](http://localhost:5601/bundles/vendors.bundle.js:197:67265) Blockquote

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [September 17, 2018, 10:15am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796/4 "2018-09-17T10:15:36Z")

</div>

> [@ea1987](#):
>
> Basically you added a pair of braces,

No, I escaped all internal double-quotes `"` with a backslash `\`

```auto
"query" : "{\"must\": [{\"match\": {\"company\": \"company_1\"}},{\"match\": {\"error_type\": \"business\"}}]}"

```

See our documentation also for further examples : [Defining roles | Elastic Stack Overview [7.4] | Elastic](https://www.elastic.co/guide/en/elastic-stack-overview/current/defining-roles.html#_example)

---

<div class="post-metadata">

**Author:** ![ea1987](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ea1987/32/51356_2.png) [@ea1987](https://discuss.elastic.co/u/ea1987)\
**Post date:** [September 17, 2018, 10:52am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796/5 "2018-09-17T10:52:49Z")

</div>

> [@ea1987](#):
>
> curl --user elastic:elastic -X GET "localhost:9200/\_xpack/security/role/bus\_company1\_invoice\_status?pretty"

Found the error, this is the right role definition and it works fine! Thank you for your help!

> curl --user elastic:elastic -X GET "localhost:9200/\_xpack/security/role/bus\_company1\_invoice\_status?pretty"  
> {  
> "bus\_company1\_invoice\_status" : {  
> "cluster" : ,  
> "indices" : [  
> {  
> "names" : [  
> "invoices\_status"  
> ],  
> "privileges" : [  
> "all"  
> ],  
> "field\_security" : {  
> "grant" : [  
> "_"  
> ]  
> },  
> "query" : "{"bool": {"must": [{"match": {"company": "company\_1"}},{"match": {"error\_type": "business"}}]}}"  
> }  
> ],  
> "applications" : [  
> {  
> "application" : "kibana-.kibana",  
> "privileges" : [  
> "all"  
> ],  
> "resources" : [  
> "_"  
> ]  
> }  
> ],  
> "run\_as" : ,  
> "metadata" : { },  
> "transient\_metadata" : {  
> "enabled" : true  
> }  
> }  
> }  
> Blockquote

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2018, 10:58am UTC](https://discuss.elastic.co/t/problems-with-role-based-access-x-content-parse-exception/148796/6 "2018-10-15T10:58:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.