# What does "restricted indices" means in Security:Has privileges API? **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [June 11, 2019, 11:46am UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175 "2019-06-11T11:46:44Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![LoadingZhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loadingzhang/32/22391_2.png) [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Post date:** [June 11, 2019, 11:46am UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/1 "2019-06-11T11:46:45Z")
The document is [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/security-api-has-privileges.html#_request_body_47). What does "restricted indices" meas in "allow\_restricted\_indices" params? ---
**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\ **Post date:** [June 11, 2019, 11:50pm UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/2 "2019-06-11T23:50:24Z")
Hi @LoadingZhang, > Restricted indices (currently only `.security*` ) are special internal indices that require setting the `allow_restricted_indices` flag on every index permission that covers them. If this flag is `false` (default) the permission will not cover these and actions against them will not be authorized. The security index is used by the security module to provide security features for ES. When you define index privilege you can use `allow_restricted_indices` flag to authorize the user access to restricted indices. Hope this helps. Thanks and Regards, Yogesh Gaikwad ---
**Author:** ![LoadingZhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loadingzhang/32/22391_2.png) [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Post date:** [June 12, 2019, 3:27am UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/3 "2019-06-12T03:27:50Z")
Thanks for reply. I hope we can customize restricted indices in the future. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 12, 2019, 6:07am UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/4 "2019-06-12T06:07:34Z")
> [@LoadingZhang](#): > > I hope we can customize restricted indices in the future. Restricted indices are an internal structure of Elasticsearch and shouldn't affect the way you interact with it. Can you help us understand why you'd want that? How is the current implementation limiting you in any way and what would you like to customize regarding restricted indices? ---
**Author:** ![LoadingZhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loadingzhang/32/22391_2.png) [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Post date:** [June 13, 2019, 9:07am UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/5 "2019-06-13T09:07:32Z")
For example: I assign privileges of `index_*` to role `A`, but I don't want `A` to access `index_special*`. I can set `restricted indices` params to do it. ```json "index" : [ { "names": ["index_*"], "privileges": ["all"], "restricted_indices": ["index_special*"] } ] ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [June 14, 2019, 2:55pm UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/6 "2019-06-14T14:55:19Z")
Hi, This is not what the parameter `allow_restricted_indices` is about, and we do not have any plans to change it to fit this use case. You can , however, fit your use case of > assign privileges of `index_*` to role `A` , but I don't want `A` to access `index_special*` with a regular expression and a name pattern of `/index_~(special@)/` ---
**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\ **Post date:** [June 17, 2019, 3:51am UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/7 "2019-06-17T03:51:46Z")
Hi @LoadingZhang, What @ikakavas mentioned is true and the pattern used for your use case, Elasticsearch uses Lucene automaton and regex to match the index name pattern that you configure in the role. See documentation for further details: [https://lucene.apache.org/core/7\_0\_1/core/org/apache/lucene/util/automaton/RegExp.html](https://lucene.apache.org/core/7_0_1/core/org/apache/lucene/util/automaton/RegExp.html) that might help you. Regards, Yogesh Gaikwad ---
**Author:** ![LoadingZhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/loadingzhang/32/22391_2.png) [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Post date:** [June 20, 2019, 3:03am UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/8 "2019-06-20T03:03:03Z")
Thanks @Yogesh_Gaikwad @ikakavas.😃 I will try the way to exclude indices first(though a little troublesome). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 18, 2019, 3:03am UTC](https://discuss.elastic.co/t/what-does-restricted-indices-means-in-security-has-privileges-api/185175/9 "2019-07-18T03:03:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.