[security_exception] action [indices:data/read/search] is unauthorized for user [user]

Elastic Observability APM
3

sure, more specific (in terms of visibility): everything is accessible except for actual charts (see attached screenshot)

image
image.png2490×1484 267 KB

and yes, I followed instruction explicitly. kibana_user role is already part of user's role.

GET _xpack/security/role/apm_reader:

{
  "apm_reader" : {
    "cluster" : [ ],
    "indices" : [
      {
        "names" : [
          "apm-*"
        ],
        "privileges" : [
          "read",
          "view_index_metadata"
        ]
      }
    ],
    "applications" : [ ],
    "run_as" : [ ],
    "metadata" : { },
    "transient_metadata" : {
      "enabled" : true
    }
  }
}

GET _xpack/security/_authenticate:

{
  "username" : "user",
  "roles" : [
    "kibana_user",
    "apm_reader"
  ],
  "full_name" : "xxx",
  "email" : "x@x.x",
  "metadata" : { },
  "enabled" : true
}