# Warning in Rules

**URL:** <https://discuss.elastic.co/t/warning-in-rules/290036>\
**Category:** Elastic Security\
**Created:** [November 24, 2021, 9:35am UTC](https://discuss.elastic.co/t/warning-in-rules/290036 "2021-11-24T09:35:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![norgro2601](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/norgro2601/32/33292_2.png) [@norgro2601](https://discuss.elastic.co/u/norgro2601)\
**Post date:** [November 24, 2021, 9:35am UTC](https://discuss.elastic.co/t/warning-in-rules/290036/1 "2021-11-24T09:35:30Z")

</div>

Hi,

I have an environment with several spaces to separate access to different indices, e.g. space a has only access to indices "filebeat-a-\*", space b to "filebeat-b-\*".

In Security I've activated some of the provided rules in space a with a user, who has only access to the "filebeat-a-\*" indices.

The rules then throw a warning: "Missing required read privileges on the following indices: ["filebeat-\*"]".

My question: Are the rules executing against the "filebeat-a-\*" indices despite this warning or do the rules not execute at all and I must clone any rule I want to use and change the setting in the new rule to "filebeat-a-\*"?

Best regards,  
Norbert

---

<div class="post-metadata">

**Author:** ![Jonathan\_Buttner](https://avatars.discourse-cdn.com/v4/letter/j/9d8465/32.png) [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)\
**Post date:** [November 24, 2021, 8:31pm UTC](https://discuss.elastic.co/t/warning-in-rules/290036/2 "2021-11-24T20:31:53Z")

</div>

Hey @norgro2601 thanks for reaching out!

I believe the warning is indicating that the rule will not being executing because it is attempting to read on the index pattern `filebeat-*` and does not have permissions to do so.

> [@norgro2601](#):
>
> and I must clone any rule I want to use and change the setting in the new rule to "filebeat-a-\*"?

Yeah unfortunately I think you'll need to clone the rules you'd like to run and modify them such that they use the index pattern `filebeat-a-*`.

---

<div class="post-metadata">

**Author:** ![norgro2601](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/norgro2601/32/33292_2.png) [@norgro2601](https://discuss.elastic.co/u/norgro2601)\
**Post date:** [November 25, 2021, 9:44am UTC](https://discuss.elastic.co/t/warning-in-rules/290036/3 "2021-11-25T09:44:17Z")

</div>

Hey @Jonathan_Buttner,

does this mean, that also the setting in the space, which Elasticsearch indices will be used for the Security solution, is ignored, and it must be filebeat-\* anyway?

Then the only possible solution to avoid clones and achieving the same result is to have a setting in a role, that allows access to filebeat-\* in general but uses a "Grant read privileges to specific documents" filter, that only allows access to the documents in filebeat-a-\*, right?

Kind regards,  
Norbert

---

<div class="post-metadata">

**Author:** ![norgro2601](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/norgro2601/32/33292_2.png) [@norgro2601](https://discuss.elastic.co/u/norgro2601)\
**Post date:** [November 26, 2021, 8:21am UTC](https://discuss.elastic.co/t/warning-in-rules/290036/4 "2021-11-26T08:21:06Z")

</div>

Hey @Jonathan_Buttner,

good news, this warning is just an information and doesn't prevent the rule from working.

Fortunately, today I noticed that the rule "Threat Intel Filebeat Module Indicator Match", that was still activated, created some new alerts.

Kind regards,  
Norbert

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2021, 8:21am UTC](https://discuss.elastic.co/t/warning-in-rules/290036/5 "2021-12-24T08:21:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.