Query to find all the users with one role

Hi Team,

How can I find the user in ELK with one particular role.

I can get all the users with following query:

GET /_security/user

but when I try to find user with a role

GET /_security/user/
{
  "query":"select full_name, where roles ==  kibana_system"
}

I am getting following error:

{
  "error" : {
    "root_cause" : [
      {
        "type" : "illegal_argument_exception",
        "reason" : "request [GET /_security/user/] does not support having a body"
      }
    ],
    "type" : "illegal_argument_exception",
    "reason" : "request [GET /_security/user/] does not support having a body"
  },
  "status" : 400
}

Can some one help me here?
Thanks in advance

_security is an API endpoint, which you can tell by the use of the _ prefix.

Try GET .security/_search instead, as that is the index that you are actually wanting the data from.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.