# Role mappings of all matched users in Elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [July 12, 2020, 5:53pm UTC](https://discuss.elastic.co/t/role-mappings-of-all-matched-users-in-elasticsearch/240850 "2020-07-12T17:53:49Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![soumendra](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@soumendra](https://discuss.elastic.co/u/soumendra)\ **Post date:** [July 12, 2020, 5:53pm UTC](https://discuss.elastic.co/t/role-mappings-of-all-matched-users-in-elasticsearch/240850/1 "2020-07-12T17:53:49Z")
How to fetch all the role mappings of a single user in Elasticsearch. I have role mapping like this: ```auto "sdbsd21tdsbjvbriuu": { "enabled": true, "roles": [ "kibana_dashboard_only_user", "5e3bb57222b49800016b666f" ], "rules": { "all": [ { "field": { "realm.name": "oidc1" } }, { "field": { "username": [ "user001@one.com", "User002@two.com", "USER003@three.com" ] } } ] }, "metadata": { "migrated": false } } ``` For e.g. `user001@one.com` can be there across multiple role-mappings. I want to fetch all the role-mappings with `user001@one.com`. How to do that? I have tried to search the `security-7` index. However, unable to get a single search query for this. ```auto GET .security-7/_search { "query": { "bool": { "must": [ { "term": { "doc_type": "role-mapping" } } ] } } } ``` ---
**Author:** ![Vinayak\_Sapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinayak_sapre/32/45939_2.png) [@Vinayak\_Sapre](https://discuss.elastic.co/u/Vinayak_Sapre)\ **Post date:** [July 12, 2020, 9:21pm UTC](https://discuss.elastic.co/t/role-mappings-of-all-matched-users-in-elasticsearch/240850/2 "2020-07-12T21:21:12Z")
@soumendra I am assuming username and roles fields are defined as text with a "keyword" as child field. See if this works ```auto { "query": { "bool": { "filter": [ { "term": { "sdbsd21tdsbjvbriuu.rules.all.field.username.keyword": "User002@two.com" } } ] } }, "aggs": { "roles": { "terms": { "field": "sdbsd21tdsbjvbriuu.roles.keyword" } } } } ``` If not, can you post .security-7 mappings? ---
**Author:** ![soumendra](https://avatars.discourse-cdn.com/v4/letter/s/b2d939/32.png) [@soumendra](https://discuss.elastic.co/u/soumendra)\ **Post date:** [July 13, 2020, 4:35am UTC](https://discuss.elastic.co/t/role-mappings-of-all-matched-users-in-elasticsearch/240850/3 "2020-07-13T04:35:46Z")
`security-7` index role mapping: ```auto { ".security-7": { "mappings": { "dynamic": "strict", "_meta": { "security-version": "7.6.2" }, "properties": { "access_token": { "properties": { "invalidated": { "type": "boolean" }, "realm": { "type": "keyword" }, "user_token": { "properties": { "authentication": { "type": "binary" }, "expiration_time": { "type": "date", "format": "epoch_millis" }, "id": { "type": "keyword" }, "metadata": { "type": "object", "dynamic": "false" }, "version": { "type": "integer" } } } } }, "actions": { "type": "keyword" }, "api_key_hash": { "type": "keyword", "index": false, "doc_values": false }, "api_key_invalidated": { "type": "boolean" }, "application": { "type": "keyword" }, "applications": { "properties": { "application": { "type": "keyword" }, "privileges": { "type": "keyword" }, "resources": { "type": "keyword" } } }, "cluster": { "type": "keyword" }, "creation_time": { "type": "date", "format": "epoch_millis" }, "creator": { "properties": { "metadata": { "type": "object", "dynamic": "false" }, "principal": { "type": "keyword" }, "realm": { "type": "keyword" } } }, "doc_type": { "type": "keyword" }, "email": { "type": "text", "analyzer": "email" }, "enabled": { "type": "boolean" }, "expiration_time": { "type": "date", "format": "epoch_millis" }, "full_name": { "type": "text" }, "global": { "properties": { "application": { "properties": { "manage": { "properties": { "applications": { "type": "keyword" } } } } } } }, "indices": { "properties": { "allow_restricted_indices": { "type": "boolean" }, "field_security": { "properties": { "except": { "type": "keyword" }, "grant": { "type": "keyword" } } }, "names": { "type": "keyword" }, "privileges": { "type": "keyword" }, "query": { "type": "keyword" } } }, "limited_by_role_descriptors": { "type": "object", "enabled": false }, "metadata": { "type": "object", "dynamic": "false" }, "name": { "type": "keyword" }, "password": { "type": "keyword", "index": false, "doc_values": false }, "refresh_token": { "properties": { "client": { "properties": { "realm": { "type": "keyword" }, "type": { "type": "keyword" }, "user": { "type": "keyword" } } }, "invalidated": { "type": "boolean" }, "refresh_time": { "type": "date", "format": "epoch_millis" }, "refreshed": { "type": "boolean" }, "superseding": { "properties": { "encrypted_tokens": { "type": "binary" }, "encryption_iv": { "type": "binary" }, "encryption_salt": { "type": "binary" } } }, "token": { "type": "keyword" } } }, "role_descriptors": { "type": "object", "enabled": false }, "role_templates": { "properties": { "format": { "type": "keyword" }, "template": { "type": "text" } } }, "roles": { "type": "keyword" }, "rules": { "type": "object", "dynamic": "false" }, "run_as": { "type": "keyword" }, "type": { "type": "keyword" }, "username": { "type": "keyword" }, "version": { "type": "integer" } } } } } ``` ---
**Author:** ![Vinayak\_Sapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vinayak_sapre/32/45939_2.png) [@Vinayak\_Sapre](https://discuss.elastic.co/u/Vinayak_Sapre)\ **Post date:** [July 13, 2020, 5:11am UTC](https://discuss.elastic.co/t/role-mappings-of-all-matched-users-in-elasticsearch/240850/4 "2020-07-13T05:11:48Z")
> [@soumendra](#): > > ```auto > "rules": { > "type": "object", > "dynamic": "false" > }, > > ``` Sub-fields of rules are not indexed which contain user info. You can't filter on username. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 10, 2020, 5:11am UTC](https://discuss.elastic.co/t/role-mappings-of-all-matched-users-in-elasticsearch/240850/5 "2020-08-10T05:11:49Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.