Query to find all the users with one role

Elastic Stack Elasticsearch
1

Hi Team,

How can I find the user in ELK with one particular role.

I can get all the users with following query:

GET /_security/user

but when I try to find user with a role

GET /_security/user/
{
  "query":"select full_name, where roles ==  kibana_system"
}

I am getting following error:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "request [GET /_security/user/] does not support having a body"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "request [GET /_security/user/] does not support having a body"
  },
  "status" : 400
}

Can some one help me here?
Thanks in advance

2

_security is an API endpoint, which you can tell by the use of the _ prefix.

Try GET .security/_search instead, as that is the index that you are actually wanting the data from.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.