Restrict access to particular elasticsearch index for a given user?

[woolfie]

Can this be used to restrict access to a particular index for a given user?

Currently, I think once logged in a user could create a new dashboard (by going to the root URL) and select whichever index they would like.

It would be great if this root URL could be restricted so that users were only able to access pre-built dashboards, or prevented from changing the index that a dashboard can access.

[Vineeth-Mohan]

I am voting for this issue. Let me know if there is any current efforts on this. If not I am willing to contribute this feature.

[wjimenez5271]

Yes +1 for this

[yang66]

see the pull request #18

[Vineeth-Mohan]

@coogleyou - I would prefer it as user should be able to access indices with pattern logstash-%user%-user

[strima]

@vineeth: could you elaborate this ? since the filter is regex based i mean it's no problem that you do something like this in your index_filter_file:

usernameA:^logstash-usernameA-.+
usernameB:^logstash-usernameB-.+

i personally see no sense in setting such things programmatically (but on the other hand i wrote this pull request this way)

[Vineeth-Mohan]

@strima - Well instead of mapping users to indices in the proxy , I map them by index name.
My index names are in format -logstash-date and only if it starts with the username , can a user use that particular index.

My point here is that , when a new user comes , i dont want to add any config change on proxy side , rather it should be seemless.

[misawsneto]

+1

[javifr]

Did you saw this?
https://www.elastic.co/blog/restricting-users-kibana-filtered-aliases

[strima]

@javifr - yes i saw this, but personally didn't find it that elegant ;)

[strima]

@Vineeth-Mohan - ok, one last question before i implement your wishes: you said you dont want to do any config changes on proxy side - so how do you enable a new user ? did you see my last commits where i added a filewatcher , so that if you change anything in the index_filter_file or in the basic auth file it gets reloaded by the application w/o need to restart ?

for the concrete thingie: what would you vote for ?

one username defined per convention in index_filter_file which can take the %user% placeholder, e.g.: GLOBALSETTINGS:^logstash-%user%-

or the left part of one line in the index_filter_file being also a regex instead of just an string

?