# RBAC on multiple project RUM data
**URL:** https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [January 22, 2023, 5:16pm UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688 "2023-01-22T17:16:58Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [January 22, 2023, 5:16pm UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/1 "2023-01-22T17:16:58Z")
Hello Team,
We have formed observability setup receiving data from multiple projects with basic license. and all projects data going to common index of APM & RUM.
Elasticsearch - 8.4.3
Kibana - 8.4.3
APM - 8.4.3
We have given seperate service name to the services of different projects.
Problem STatement:
Here we need to setup RBAC to allow APM & RUM data access respective to there projects based on service name. is there any possibility to setup RBAC to fulfill this requirement
Regards
Pratiksha
---
### Author:  [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)
#### Post date: [January 23, 2023, 2:29pm UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/2 "2023-01-23T14:29:01Z")
Hi @pratikshatiwari , if it's acceptable, try to create different indices and spaces for both projects, it would be a much better and manageable solution for multi-tenant ESaaS.
If you still want to have RBAC based on service name, you can create `query` based roles and map them to your users. Refer: [Defining roles | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv)
---
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [January 26, 2023, 6:07pm UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/3 "2023-01-26T18:07:40Z")
Hi @Ayush_Mathur
Thank you for your reply
As per first solution it requires seperate target index for each project, but my problem is how do i set the seperate index name in APM & RUM configuration in one elasticsearch cluster
E.g
if project A sends the APM & RUM data to elasticsearch cluster "XYZ "it should go to index "A"
And
if project B sends the APM & RUM data to elasticsearch cluster "XYZ "it should go to index "B"
but i am not sure how do i achieve this if the cluster is same for both the cluster as APM & RUM create its own index format
And for the second solution to achieve field based authentication we may need minimum platinum license which we are not planning
Kindly suggest
Regards
Pratiksha
---
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [January 27, 2023, 6:52am UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/4 "2023-01-27T06:52:27Z")
Hi @Ayush_Mathur
Also PFB configuration detail how i have setup my application to send data to APM server to send APM & RUM data
APM Configuration as below:
appsettings.json
"ElasticApm": {
"ServerUrls": "[https://XX.XX.XX.XX:8200](https://XX.XX.XX.XX:8200)",
"ServerCert": "~/lib/cert/ca.crt",
"VerifyServerCert": "true",
"SecretToken": "",
"ServiceName": "ecommerce-eshop",
"Environment": "DEV"
}
RUM configuration appeneded in html file setting as below:
```
```
---
### Author:  [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)
#### Post date: [January 27, 2023, 9:33am UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/5 "2023-01-27T09:33:43Z")
I believe there was something similar raised in Elastic github which provides some alternatives for the first option: [Support to create index for each service · Issue #4025 · elastic/apm-server · GitHub](https://github.com/elastic/apm-server/issues/4025)
Also, you can probably update the underlying index template according to your requirements: [View the Elasticsearch index template | APM User Guide [8.6] | Elastic](https://www.elastic.co/guide/en/apm/guide/current/custom-index-template.html)
OR create an ingest pipeline to define your index before actually storing the document in Elasticsearch: [Parse data using ingest pipelines | APM User Guide [master] | Elastic](https://www.elastic.co/guide/en/apm/guide/master/ingest-pipelines.html)
---
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [January 27, 2023, 10:26am UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/6 "2023-01-27T10:26:40Z")
Hi @Ayush_Mathur
Thank you again for reply, i am trying to follow the comments you share, will you be able to help with sample configuration where i need to apply the changes
As per shared links i need to create ingest pipeline in elasticsearch cluster but how do i map the pipeline to my agents
Do u have any sample configuration which i can refer
Regards
Pratiksha
---
### Author:  [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)
#### Post date: [January 27, 2023, 2:01pm UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/7 "2023-01-27T14:01:44Z")
Hi @pratikshatiwari , you can possibly follow this section of Elastic documentation: [Ingest pipelines | Elasticsearch Guide [8.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-fleet-elastic-agent)
---
### Author:  [@pratikshatiwari](https://discuss.elastic.co/u/pratikshatiwari)
#### Post date: [February 2, 2023, 9:15am UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/8 "2023-02-02T09:15:29Z")
hi @Ayush_Mathur
i will try this out in my setup at present i am not finding correct steps to implement this approach. if you have some will helpful
Regards
pratiksha
---
### Author:  [@Ayush\_Mathur](https://discuss.elastic.co/u/Ayush_Mathur)
#### Post date: [February 2, 2023, 12:36pm UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/9 "2023-02-02T12:36:20Z")
Hi @pratikshatiwari I haven't worked in particular with Elastic Agent or APM, but the basic principle behind ingest pipelines remains the same. You need to identify some field based on which you can move the log to a particular index. Once you have that, you can use `script` processor pipeline to update `ctx._index` based on string matching/existence of your field.
For instance, if I know that `agent.module=apm` for APM logs and `agent.module=rum` for RUM logs, I can create a script processor based pipeline as:
```auto
{
"description": "decide index:apm.* or index:rum.*",
"processors": [{
"script": {
"source": """if(ctx['@timestamp'] != null) {
def year = ctx['@timestamp'].substring(0,4); def month = ctx['@timestamp'].substring(5,7); def date = ctx['@timestamp'].substring(8,10);
StringBuffer buff;
if(ctx['agent.module'].equals("apm") {
buff = new StringBuffer(' **apm**.'.concat(year).concat('.').concat(month).concat('.').concat(date)
} else if(ctx['agent.module'].equals("rum") {
buff = new StringBuffer(' **rum**.'.concat(year).concat('.').concat(month).concat('.').concat(date)
}
ctx._index = buff.toString();
}"""
}
}
]
}
```
This should tell ES that the above log will be stored in `ctx._index` index which is essentially updated in the pipeline. By default, `ctx._index` is populated by log shipper based on indices setting defined in its configuration and hence logs are stored in that index.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 2, 2023, 12:36pm UTC](https://discuss.elastic.co/t/rbac-on-multiple-project-rum-data/323688/10 "2023-03-02T12:36:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.