# Role to use grok debugger, and console granular access control **URL:** \ **Category:** Kibana\ **Created:** [November 29, 2017, 3:44pm UTC](https://discuss.elastic.co/t/role-to-use-grok-debugger-and-console-granular-access-control/109619 "2017-11-29T15:44:19Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Suny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suny/32/22082_2.png) [@Suny](https://discuss.elastic.co/u/Suny)\ **Post date:** [November 29, 2017, 3:44pm UTC](https://discuss.elastic.co/t/role-to-use-grok-debugger-and-console-granular-access-control/109619/1 "2017-11-29T15:44:19Z")
We are using Shield (Security) and created some power user accounts. They have the following roles assigned: kibana\_user monitoring\_user reporting\_user logstash\_admin read\_all Those are all built in roles from [https://www.elastic.co/guide/en/x-pack/6.x/built-in-roles.html](https://www.elastic.co/guide/en/x-pack/6.x/built-in-roles.html) except for read\_all, which gives them read on all indices. (It's their data, anyway; We separate clients by cluster.) Things basically work fine, except for two small issues: 1. They cannot use the Grok Debugger. We have xpack.grokdebugger.enabled ([https://www.elastic.co/guide/en/kibana/current/dev-settings-kb.html](https://www.elastic.co/guide/en/kibana/current/dev-settings-kb.html)), however, it worked for them only when we gave them superuser (which we had to take away again). I'm not sure why this isn't allowed for lesser beings. (It's not a blocker since they can still use online tools - but that's not what you built the grok debugger for, is it.) 2. We cannot control who's allowed to use the console and who isn't per Shield user - only per Kibana instance (console.enabled, [https://www.elastic.co/guide/en/kibana/current/settings.html](https://www.elastic.co/guide/en/kibana/current/settings.html)), and we currrently have only one. It would be cool if this could be controlled by role. Again, it's not deadly. Are there any plans to make the grok debugger accessible for non superuser? Or to control access to both grokk debugger and console via roles? ---
**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\ **Post date:** [November 29, 2017, 10:39pm UTC](https://discuss.elastic.co/t/role-to-use-grok-debugger-and-console-granular-access-control/109619/2 "2017-11-29T22:39:51Z")
Hi, The grok\_debugger is using elasticsearch's [simulate](https://www.elastic.co/guide/en/elasticsearch/reference/master/simulate-pipeline-api.html) API - the permissions you'd need would look something like ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11985ec04fde00b002c86ed4ea268b61672c5bc5.png). You could then add that role to anyone using the grok debugger. Note that "manage" allows all CRUD operations on pipelines, so it may not be an option. Thumbs up on disabling apps per user. There are thoughts for more access control in Kibana but it's likely a ways out. ---
**Author:** ![Suny](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suny/32/22082_2.png) [@Suny](https://discuss.elastic.co/u/Suny)\ **Post date:** [December 5, 2017, 4:30pm UTC](https://discuss.elastic.co/t/role-to-use-grok-debugger-and-console-granular-access-control/109619/3 "2017-12-05T16:30:58Z")
> [@jbudz](#): > > grok debugger Thanks, that works! The background information is also helpful. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 2, 2018, 4:31pm UTC](https://discuss.elastic.co/t/role-to-use-grok-debugger-and-console-granular-access-control/109619/4 "2018-01-02T16:31:18Z")
Closed on January 2, 2018, 4:31pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.