[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-elasticsearch-authz":3,"mdc--ju8gh4-key":34,"related-org-elastic-elasticsearch-authz":5588,"related-repo-elastic-elasticsearch-authz":5746},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"RBAC","rbac",{"name":21,"slug":22,"type":15},"Elasticsearch","elasticsearch",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:47:36.394177",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fplugins\u002Felasticsearch\u002Fskills\u002Felasticsearch-authz","---\nname: elasticsearch-authz\ndescription: >\n  Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level\n  security. Use when creating users or roles, assigning privileges, or mapping external\n  realms like LDAP\u002FSAML.\ncompatibility: >\n  Requires network access to Elasticsearch. Kibana endpoint needed for Kibana role\n  API. Serverless role assignment requires the cloud-access-management skill.\nmetadata:\n  author: elastic\n  version: 0.1.1\n---\n\n# Elasticsearch Authorization\n\nManage Elasticsearch role-based access control: native users, roles, role assignment, and role mappings for external\nrealms.\n\nFor authentication methods and API key management, see the **elasticsearch-authn** skill.\n\nFor detailed API endpoints, see [references\u002Fapi-reference.md](references\u002Fapi-reference.md).\n\n> **Deployment note:** Feature availability differs between self-managed, ECH, and Serverless. See\n> [Deployment Compatibility](#deployment-compatibility) for details.\n\n## Jobs to Be Done\n\n- Create a native user with a specific set of privileges\n- Define a custom role with least-privilege index and cluster access\n- Assign one or more roles to an existing user\n- Create a role with Kibana feature or space privileges\n- Configure a role mapping for external realm users (SAML, LDAP, PKI)\n- Derive role assignments dynamically from user attributes (Mustache templates)\n- Restrict document visibility per user or department (document-level security)\n- Hide sensitive fields like PII from certain roles (field-level security)\n- Implement attribute-based access control (ABAC) using templated role queries\n- Translate a natural-language access request into user, role, and role mapping tasks\n\n## Prerequisites\n\n| Item                   | Description                                                                |\n| ---------------------- | -------------------------------------------------------------------------- |\n| **Elasticsearch URL**  | Cluster endpoint (e.g. `https:\u002F\u002Flocalhost:9200` or a Cloud deployment URL) |\n| **Kibana URL**         | Required only when setting Kibana feature\u002Fspace privileges                 |\n| **Authentication**     | Valid credentials (see the elasticsearch-authn skill)                      |\n| **Cluster privileges** | `manage_security` is required for user and role management operations      |\n\nPrompt the user for any missing values.\n\n## Decomposing Access Requests\n\nWhen the user describes access in natural language (e.g. \"create a user that has read-only access to `logs-*`\"), break\nthe request into discrete tasks before executing. Follow this workflow:\n\n### Step 1 — Identify the components\n\nExtract from the prompt:\n\n| Component        | Question to answer                                                        |\n| ---------------- | ------------------------------------------------------------------------- |\n| **Who**          | New native user, existing user, or external realm user (LDAP, SAML, etc.) |\n| **What**         | Which indices, data streams, or Kibana features                           |\n| **Access level** | Read, write, manage, or a specific set of privileges                      |\n| **Scope**        | All documents\u002Ffields, or restricted by region, department, sensitivity?   |\n| **Kibana?**      | Does the request mention any Kibana feature (dashboards, Discover, etc.)  |\n| **Deployment?**  | Self-managed, ECH, or Serverless? Serverless has a different user model.  |\n\n### Step 2 — Check for existing roles\n\nBefore creating a new role, check if an existing role already grants the required access:\n\n```bash\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\" \u003Cauth_flags>\n```\n\nIf a matching role exists, skip role creation and reuse it.\n\n### Step 3 — Create the role (if needed)\n\nDerive a role name and display name from the request. Use the Elasticsearch API for pure index\u002Fcluster roles. Use the\nKibana API if Kibana features are involved (see [Choosing the right API](#choosing-the-right-api)).\n\n### Step 4 — Create or update the user\n\n| Scenario                 | Action                                                                                                                               |\n| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ |\n| **New native user**      | Create the user with the role and a strong generated password. (Self-managed \u002F ECH only.)                                            |\n| **Existing native user** | Fetch current roles, append the new role, update the user with the full array. (Self-managed \u002F ECH only.)                            |\n| **External realm user**  | Create a role mapping that matches the user's realm attributes to the role. (Self-managed \u002F ECH only.)                               |\n| **Serverless user**      | Use the **cloud-access-management** skill. Assign a predefined role or create a custom role first, then assign it via the Cloud API. |\n\n### Example decomposition\n\n**Prompt:** \"Create a user `analyst` with read-only access to `logs-*` and `metrics-*` and view dashboards in Kibana.\"\n\n1. Identify: new user `analyst`, indices `logs-*`\u002F`metrics-*`, dashboards, read access.\n1. Check roles: `GET \u002F_security\u002Frole` — no match.\n1. Create role via Kibana API (dashboards involved): `logs-metrics-dashboard-viewer`.\n1. Create user: `POST \u002F_security\u002Fuser\u002Fanalyst` with `roles: [\"logs-metrics-dashboard-viewer\"]`.\n\nConfirm each step with the user if the request is ambiguous.\n\n## Manage Native Users\n\n> Native user management applies to self-managed and ECH deployments. On Serverless, users are managed at the\n> organization level — skip this section.\n\n### Create a user\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"password\": \"'\"${PASSWORD}\"'\",\n    \"roles\": [\"'\"${ROLE_NAME}\"'\"],\n    \"full_name\": \"'\"${FULL_NAME}\"'\",\n    \"email\": \"'\"${EMAIL}\"'\",\n    \"enabled\": true\n  }'\n```\n\n### Update a user\n\nUse `PUT \u002F_security\u002Fuser\u002F${USERNAME}` with the fields to change. Omit `password` to keep the existing one.\n\n### Other user operations\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\u002F_password\" \\\n  \u003Cauth_flags> -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"password\": \"'\"${NEW_PASSWORD}\"'\"}'\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\u002F_disable\" \u003Cauth_flags>\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\u002F_enable\" \u003Cauth_flags>\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\" \u003Cauth_flags>\ncurl -X DELETE \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\" \u003Cauth_flags>\n```\n\n## Manage Roles\n\n### Choosing the right API\n\nUse the **Elasticsearch API** (`PUT \u002F_security\u002Frole\u002F{name}`) when the role only needs `cluster` and `indices`\nprivileges. This is the default — no Kibana endpoint is required.\n\nUse the **Kibana role API** (`PUT \u002Fapi\u002Fsecurity\u002Frole\u002F{name}`) when the role includes any Kibana feature or space\nprivileges. The Elasticsearch API cannot set Kibana feature grants, space scoping, or base privileges, so if the user\nmentions Kibana features like Discover, Dashboards, Maps, Visualize, Canvas, or any other Kibana application, the Kibana\nAPI is required.\n\nIf the Kibana endpoint is not available or API key authentication to Kibana fails, fall back to the Elasticsearch API\nfor the `cluster` and `indices` portion and warn the user that Kibana privileges could not be set. Prompt for a Kibana\nURL or alternative credentials before giving up.\n\n### Create or update a role (Elasticsearch API)\n\nDefault choice when the role has only index and cluster privileges:\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002F${ROLE_NAME}\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"'\"${ROLE_DISPLAY_NAME}\"'\",\n    \"cluster\": [],\n    \"indices\": [\n      {\n        \"names\": [\"'\"${INDEX_PATTERN}\"'\"],\n        \"privileges\": [\"read\", \"view_index_metadata\"]\n      }\n    ]\n  }'\n```\n\n### Create or update a role (Kibana API)\n\nRequired when the role includes Kibana feature or space privileges:\n\n```bash\ncurl -X PUT \"${KIBANA_URL}\u002Fapi\u002Fsecurity\u002Frole\u002F${ROLE_NAME}\" \\\n  \u003Cauth_flags> \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"'\"${ROLE_DISPLAY_NAME}\"'\",\n    \"elasticsearch\": {\n      \"cluster\": [],\n      \"indices\": [\n        {\n          \"names\": [\"'\"${INDEX_PATTERN}\"'\"],\n          \"privileges\": [\"read\", \"view_index_metadata\"]\n        }\n      ]\n    },\n    \"kibana\": [\n      {\n        \"base\": [],\n        \"feature\": {\n          \"discover\": [\"read\"],\n          \"dashboard\": [\"read\"]\n        },\n        \"spaces\": [\"*\"]\n      }\n    ]\n  }'\n```\n\n### Get, list, and delete roles\n\n```bash\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002F${ROLE_NAME}\" \u003Cauth_flags>\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\" \u003Cauth_flags>\ncurl -X DELETE \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002F${ROLE_NAME}\" \u003Cauth_flags>\n```\n\n## Document-Level and Field-Level Security\n\nRoles can restrict access at the document and field level within an index, going beyond index-level privileges.\n\n### Field-level security (FLS)\n\nRestrict which fields a role can see. Use `grant` to whitelist or `except` to blacklist fields:\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002Fpii-redacted-reader\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"PII Redacted Reader\",\n    \"indices\": [\n      {\n        \"names\": [\"customers-*\"],\n        \"privileges\": [\"read\"],\n        \"field_security\": {\n          \"grant\": [\"*\"],\n          \"except\": [\"ssn\", \"credit_card\", \"date_of_birth\"]\n        }\n      }\n    ]\n  }'\n```\n\nUsers with this role see all fields except the PII fields. FLS is enforced on search, get, and aggregation results.\n\n### Document-level security (DLS)\n\nRestrict which documents a role can see by attaching a query filter:\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002Femea-logs-reader\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"EMEA Logs Reader\",\n    \"indices\": [\n      {\n        \"names\": [\"logs-*\"],\n        \"privileges\": [\"read\"],\n        \"query\": \"{\\\"term\\\": {\\\"region\\\": \\\"emea\\\"}}\"\n      }\n    ]\n  }'\n```\n\nThe `query` field is a JSON string containing a Query DSL filter. Users with this role only see documents where `region`\nequals `emea`.\n\n### Templated DLS queries (ABAC)\n\nDLS queries support Mustache templates that inject user metadata at query time, enabling attribute-based access control\n(ABAC) on top of RBAC. Store user-specific attributes in the user's `metadata` field, then reference them in the role\nquery template with `{{_user.metadata.\u003Ckey>}}`.\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002Fdepartment-reader\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"Department Reader\",\n    \"indices\": [\n      {\n        \"names\": [\"records-*\"],\n        \"privileges\": [\"read\"],\n        \"query\": \"{\\\"template\\\": {\\\"source\\\": \\\"{\\\\\\\"term\\\\\\\": {\\\\\\\"department\\\\\\\": \\\\\\\"{{_user.metadata.department}}\\\\\\\"}}\\\"}}\"\n      }\n    ]\n  }'\n```\n\nA user with `\"metadata\": {\"department\": \"engineering\"}` only sees documents where `department` equals `engineering`. The\nsame role works for all departments — no per-department role needed.\n\nFor multi-valued attributes (e.g. a list of required programs), use `terms_set` with `minimum_should_match_field` to\nensure the user holds all required attributes listed on the document. This enables complex ABAC policies — combining\nsecurity levels, program lists, and certification dates — using a single role. See\n[references\u002Fapi-reference.md](references\u002Fapi-reference.md) for full `terms_set` ABAC examples including combined\nmulti-condition policies and user metadata setup.\n\n### Combining DLS and FLS\n\nA single index privilege entry can include both `query` (DLS) and `field_security` (FLS). See the\n[HR department example](#restrict-hr-data-by-department-dls--fls) for a practical combined use case.\n\nWhen users hold multiple roles, DLS queries are combined with OR and FLS grants are unioned. A broad role without\nDLS\u002FFLS can unintentionally widen access. When combining roles, always verify effective permissions and ensure no\nunrestricted role overrides DLS\u002FFLS intent.\n\n## Assign Roles to Users\n\n> Self-managed and ECH only. On Serverless, use the **cloud-access-management** skill — see\n> [Serverless User Access](#serverless-user-access).\n\nUpdate the user with the new `roles` array:\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"roles\": [\"role-a\", \"role-b\"]\n  }'\n```\n\nThe `roles` array is **replaced entirely** — include all roles the user should have. Fetch the user first to see current\nroles before updating.\n\n### Verify effective permissions\n\nAfter role or user updates, verify effective access with:\n\n```bash\ncurl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F_has_privileges\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"cluster\": [\"monitor\"],\n    \"index\": [\n      {\n        \"names\": [\"'\"${INDEX_PATTERN}\"'\"],\n        \"privileges\": [\"read\", \"view_index_metadata\"]\n      }\n    ]\n  }'\n```\n\n## Manage Role Mappings\n\n> Role mappings are **not available** on Serverless (both ES API and Kibana UI are disabled). Use the\n> **cloud-access-management** skill instead — see [Serverless User Access](#serverless-user-access).\n\nRole mappings assign external-realm users (LDAP, AD, SAML, PKI) to roles based on attribute rules. Self-managed and ECH\nonly. For supported rule operators and resource fields, see\n[role mapping resource properties](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fdeploy-manage\u002Fusers-roles\u002Fcluster-or-deployment-auth\u002Frole-mapping-resources).\n\n### Static role mapping\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fsaml-default-access\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"roles\": [\"viewer\"],\n    \"enabled\": true,\n    \"rules\": {\n      \"field\": { \"realm.name\": \"saml1\" }\n    }\n  }'\n```\n\n### LDAP group-based mapping\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fldap-admins\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"roles\": [\"superuser\"],\n    \"enabled\": true,\n    \"rules\": {\n      \"all\": [\n        { \"field\": { \"realm.name\": \"ldap1\" } },\n        { \"field\": { \"groups\": \"cn=admins,ou=groups,dc=example,dc=com\" } }\n      ]\n    }\n  }'\n```\n\n### Dynamic role assignment with Mustache templates\n\nUse `role_templates` instead of `roles` to derive role names from user attributes. Scripting must be enabled.\n\n```bash\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fldap-group-roles\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"role_templates\": [\n      {\n        \"template\": { \"source\": \"{{#tojson}}groups{{\u002Ftojson}}\" },\n        \"format\": \"json\"\n      }\n    ],\n    \"enabled\": true,\n    \"rules\": {\n      \"field\": { \"realm.name\": \"ldap1\" }\n    }\n  }'\n```\n\nSee [references\u002Fapi-reference.md](references\u002Fapi-reference.md) for more Mustache patterns including realm-username\nderived roles and tiered group access.\n\n### Get, list, and delete role mappings\n\n```bash\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fsaml-default-access\" \u003Cauth_flags>\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\" \u003Cauth_flags>\ncurl -X DELETE \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fsaml-default-access\" \u003Cauth_flags>\n```\n\n## Serverless User Access\n\nOn Serverless, there are no native users or role mappings. Users receive project access through Cloud-level role\nassignments.\n\n- **Predefined roles** (e.g. `admin`, `developer`, `viewer`) cover common access patterns. If one fits, assign it\n  directly via the Cloud API — no custom role creation needed.\n- **Custom roles** are required when the user needs fine-grained access (specific indices, Kibana features, DLS\u002FFLS).\n  Create the custom role using the Elasticsearch API or Kibana API (same as self-managed — see\n  [Manage Roles](#manage-roles)), then assign it to the user alongside a predefined base role via the Cloud API.\n- **Run-as** privileges are unavailable in Serverless custom roles.\n\nUse the **cloud-access-management** skill for the full workflow (inviting users, assigning roles, managing Cloud API\nkeys, and verifying access). This skill handles only role definition; cloud-access-management handles user assignment.\n\n## Examples\n\n### Create a read-only user for logs\n\n**Request:** \"Create a user `joe` with read-only access to `logs-*`.\"\n\n1. Create the role via `PUT \u002F_security\u002Frole\u002Flogs-reader` with `\"description\": \"Logs Reader\"` and\n   `indices: [{ names: [\"logs-*\"], privileges: [\"read\", \"view_index_metadata\"] }]`.\n1. Create the user via `POST \u002F_security\u002Fuser\u002Fjoe` with `\"roles\": [\"logs-reader\"]` and a strong generated password.\n\n### Create a role with Kibana dashboard access\n\n**Request:** \"Let users read `logs-*` and view dashboards in Kibana.\"\n\nUse the Kibana API (`PUT \u003CKIBANA_URL>\u002Fapi\u002Fsecurity\u002Frole\u002Flogs-dashboard-viewer`) with `elasticsearch.indices` for data\naccess and `kibana[].feature` for dashboard and Discover read access on all spaces. See\n[Create or update a role (Kibana API)](#create-or-update-a-role-kibana-api) for the full request structure.\n\n### Add a role to an existing user\n\n**Request:** \"Give Alice access to `apm-*` in addition to her current roles.\"\n\n1. `GET \u002F_security\u002Fuser\u002Falice` — response shows `\"roles\": [\"viewer\"]`.\n1. Create `apm-reader` role with `indices: [{ names: [\"apm-*\"], privileges: [\"read\", \"view_index_metadata\"] }]`.\n1. `PUT \u002F_security\u002Fuser\u002Falice` with `\"roles\": [\"viewer\", \"apm-reader\"]` (include all roles).\n\n### Grant a Serverless user read-write access with Kibana dashboards\n\n**Request:** \"Give `alice@example.com` read-write access to the `colors` index and let her use dashboards and Discover.\"\n\n1. Create a custom role via the Kibana API: `PUT \u003CKIBANA_URL>\u002Fapi\u002Fsecurity\u002Frole\u002Fcolors-rw-kibana` with\n   `elasticsearch.indices` for `read`, `write`, `view_index_metadata` on `colors` and `kibana[].feature` for\n   `dashboard`, `discover`.\n1. Use the **cloud-access-management** skill to assign the user the custom role `colors-rw-kibana`.\n\n### Restrict HR data by department (DLS + FLS)\n\n**Request:** \"Each manager should only see HR records from their own department, and PII fields should be hidden.\"\n\n1. Create a user with department metadata: `POST \u002F_security\u002Fuser\u002Fmanager_a` with\n   `\"metadata\": {\"department\": \"engineering\"}`.\n1. Create a role with DLS + FLS:\n\n```json\nPUT \u002F_security\u002Frole\u002Fhr-department-viewer\n{\n  \"description\": \"HR Department Viewer\",\n  \"indices\": [\n    {\n      \"names\": [\"hr-*\"],\n      \"privileges\": [\"read\"],\n      \"field_security\": { \"grant\": [\"*\"], \"except\": [\"ssn\", \"salary\", \"date_of_birth\"] },\n      \"query\": \"{\\\"template\\\": {\\\"source\\\": \\\"{\\\\\\\"term\\\\\\\": {\\\\\\\"department\\\\\\\": \\\\\\\"{{_user.metadata.department}}\\\\\\\"}}\\\"}}\"\n    }\n  ]\n}\n```\n\nThe same role works for every department — each user sees only their department's records with PII fields removed.\n\n## Guidelines\n\n### Least-privilege principles\n\n- Never use the `elastic` superuser for day-to-day operations. Create dedicated minimum-privilege roles and reserve\n  `elastic` for initial setup and emergency recovery.\n- Use `read` and `view_index_metadata` for read-only data access. Leave `cluster` empty unless explicitly required.\n- Use DLS (`query`) and FLS (`field_security`) to restrict access within an index.\n\n### Named privileges only\n\nNever use internal action names (e.g. `indices:data\u002Fread\u002Fsearch`). Always use officially documented named privileges.\nPrefer fine-grained privileges (`manage_ingest_pipelines`, `monitor`) over broad ones (`manage`, `all`). See\n[references\u002Fapi-reference.md](references\u002Fapi-reference.md) for the full privilege reference tables.\n\n### Role naming conventions\n\n- Use short lowercase names with hyphens: `logs-reader`, `apm-data-viewer`, `metrics-writer`.\n- Avoid generic names like `custom-role` or `new-role`.\n- Set `description` to a short, human-readable display name — not a long sentence. It is shown in the Kibana UI as the\n  role's label. Good: `\"Logs Reader\"`, `\"APM Data Viewer\"`. Bad:\n  `\"Read-only access to all logs-* indices for the operations team\"`.\n\n### User management\n\n- Generate strong passwords by default: at least 16 characters mixing uppercase, lowercase, digits, and symbols (e.g.\n  `X9k#mP2vL!qR7wZn`). Never use placeholder values like `changeme` or `password123`.\n- Prefer disabling users over deleting them to preserve audit trail.\n- The `roles` array on a user is **replaced entirely** on update. Always fetch current roles before modifying.\n\n### Role mapping best practices\n\n- Use static `roles` for simple, fixed assignments (e.g. all SAML users get `viewer`).\n- Use `role_templates` with Mustache only when roles must be derived dynamically from user attributes.\n- Combine `all`, `any`, `field`, and `except` rules to express complex conditions without duplicating mappings.\n- Test new mappings with `enabled: false` first, then enable once verified.\n\n## Deployment Compatibility\n\nSee [references\u002Fdeployment-compatibility.md](references\u002Fdeployment-compatibility.md) for a feature matrix and detailed\nnotes on self-managed, ECH, and Serverless deployment differences.\n",{"data":35,"body":39},{"name":4,"description":6,"compatibility":36,"metadata":37},"Requires network access to Elasticsearch. Kibana endpoint needed for Kibana role API. Serverless role assignment requires the cloud-access-management skill.\n",{"author":8,"version":38},"0.1.1",{"type":40,"children":41},"root",[42,51,57,70,83,105,112,167,173,280,285,291,304,311,316,434,440,445,516,521,527,540,546,639,645,678,753,758,764,772,778,1042,1048,1069,1075,1464,1470,1475,1509,1527,1545,1551,1556,1784,1790,1795,2148,2154,2314,2320,2325,2331,2352,2554,2559,2565,2570,2748,2776,2782,2802,2980,3009,3042,3048,3076,3081,3087,3108,3121,3255,3273,3279,3284,3470,3476,3502,3516,3522,3681,3687,3866,3872,3891,4085,4096,4102,4247,4252,4257,4320,4330,4336,4342,4365,4415,4421,4436,4472,4478,4495,4554,4560,4585,4674,4680,4689,4715,5198,5203,5209,5215,5280,5286,5335,5341,5424,5430,5482,5488,5566,5571,5582],{"type":43,"tag":44,"props":45,"children":47},"element","h1",{"id":46},"elasticsearch-authorization",[48],{"type":49,"value":50},"text","Elasticsearch Authorization",{"type":43,"tag":52,"props":53,"children":54},"p",{},[55],{"type":49,"value":56},"Manage Elasticsearch role-based access control: native users, roles, role assignment, and role mappings for external\nrealms.",{"type":43,"tag":52,"props":58,"children":59},{},[60,62,68],{"type":49,"value":61},"For authentication methods and API key management, see the ",{"type":43,"tag":63,"props":64,"children":65},"strong",{},[66],{"type":49,"value":67},"elasticsearch-authn",{"type":49,"value":69}," skill.",{"type":43,"tag":52,"props":71,"children":72},{},[73,75,81],{"type":49,"value":74},"For detailed API endpoints, see ",{"type":43,"tag":76,"props":77,"children":79},"a",{"href":78},"references\u002Fapi-reference.md",[80],{"type":49,"value":78},{"type":49,"value":82},".",{"type":43,"tag":84,"props":85,"children":86},"blockquote",{},[87],{"type":43,"tag":52,"props":88,"children":89},{},[90,95,97,103],{"type":43,"tag":63,"props":91,"children":92},{},[93],{"type":49,"value":94},"Deployment note:",{"type":49,"value":96}," Feature availability differs between self-managed, ECH, and Serverless. See\n",{"type":43,"tag":76,"props":98,"children":100},{"href":99},"#deployment-compatibility",[101],{"type":49,"value":102},"Deployment Compatibility",{"type":49,"value":104}," for details.",{"type":43,"tag":106,"props":107,"children":109},"h2",{"id":108},"jobs-to-be-done",[110],{"type":49,"value":111},"Jobs to Be Done",{"type":43,"tag":113,"props":114,"children":115},"ul",{},[116,122,127,132,137,142,147,152,157,162],{"type":43,"tag":117,"props":118,"children":119},"li",{},[120],{"type":49,"value":121},"Create a native user with a specific set of privileges",{"type":43,"tag":117,"props":123,"children":124},{},[125],{"type":49,"value":126},"Define a custom role with least-privilege index and cluster access",{"type":43,"tag":117,"props":128,"children":129},{},[130],{"type":49,"value":131},"Assign one or more roles to an existing user",{"type":43,"tag":117,"props":133,"children":134},{},[135],{"type":49,"value":136},"Create a role with Kibana feature or space privileges",{"type":43,"tag":117,"props":138,"children":139},{},[140],{"type":49,"value":141},"Configure a role mapping for external realm users (SAML, LDAP, PKI)",{"type":43,"tag":117,"props":143,"children":144},{},[145],{"type":49,"value":146},"Derive role assignments dynamically from user attributes (Mustache templates)",{"type":43,"tag":117,"props":148,"children":149},{},[150],{"type":49,"value":151},"Restrict document visibility per user or department (document-level security)",{"type":43,"tag":117,"props":153,"children":154},{},[155],{"type":49,"value":156},"Hide sensitive fields like PII from certain roles (field-level security)",{"type":43,"tag":117,"props":158,"children":159},{},[160],{"type":49,"value":161},"Implement attribute-based access control (ABAC) using templated role queries",{"type":43,"tag":117,"props":163,"children":164},{},[165],{"type":49,"value":166},"Translate a natural-language access request into user, role, and role mapping tasks",{"type":43,"tag":106,"props":168,"children":170},{"id":169},"prerequisites",[171],{"type":49,"value":172},"Prerequisites",{"type":43,"tag":174,"props":175,"children":176},"table",{},[177,196],{"type":43,"tag":178,"props":179,"children":180},"thead",{},[181],{"type":43,"tag":182,"props":183,"children":184},"tr",{},[185,191],{"type":43,"tag":186,"props":187,"children":188},"th",{},[189],{"type":49,"value":190},"Item",{"type":43,"tag":186,"props":192,"children":193},{},[194],{"type":49,"value":195},"Description",{"type":43,"tag":197,"props":198,"children":199},"tbody",{},[200,226,242,258],{"type":43,"tag":182,"props":201,"children":202},{},[203,212],{"type":43,"tag":204,"props":205,"children":206},"td",{},[207],{"type":43,"tag":63,"props":208,"children":209},{},[210],{"type":49,"value":211},"Elasticsearch URL",{"type":43,"tag":204,"props":213,"children":214},{},[215,217,224],{"type":49,"value":216},"Cluster endpoint (e.g. ",{"type":43,"tag":218,"props":219,"children":221},"code",{"className":220},[],[222],{"type":49,"value":223},"https:\u002F\u002Flocalhost:9200",{"type":49,"value":225}," or a Cloud deployment URL)",{"type":43,"tag":182,"props":227,"children":228},{},[229,237],{"type":43,"tag":204,"props":230,"children":231},{},[232],{"type":43,"tag":63,"props":233,"children":234},{},[235],{"type":49,"value":236},"Kibana URL",{"type":43,"tag":204,"props":238,"children":239},{},[240],{"type":49,"value":241},"Required only when setting Kibana feature\u002Fspace privileges",{"type":43,"tag":182,"props":243,"children":244},{},[245,253],{"type":43,"tag":204,"props":246,"children":247},{},[248],{"type":43,"tag":63,"props":249,"children":250},{},[251],{"type":49,"value":252},"Authentication",{"type":43,"tag":204,"props":254,"children":255},{},[256],{"type":49,"value":257},"Valid credentials (see the elasticsearch-authn skill)",{"type":43,"tag":182,"props":259,"children":260},{},[261,269],{"type":43,"tag":204,"props":262,"children":263},{},[264],{"type":43,"tag":63,"props":265,"children":266},{},[267],{"type":49,"value":268},"Cluster privileges",{"type":43,"tag":204,"props":270,"children":271},{},[272,278],{"type":43,"tag":218,"props":273,"children":275},{"className":274},[],[276],{"type":49,"value":277},"manage_security",{"type":49,"value":279}," is required for user and role management operations",{"type":43,"tag":52,"props":281,"children":282},{},[283],{"type":49,"value":284},"Prompt the user for any missing values.",{"type":43,"tag":106,"props":286,"children":288},{"id":287},"decomposing-access-requests",[289],{"type":49,"value":290},"Decomposing Access Requests",{"type":43,"tag":52,"props":292,"children":293},{},[294,296,302],{"type":49,"value":295},"When the user describes access in natural language (e.g. \"create a user that has read-only access to ",{"type":43,"tag":218,"props":297,"children":299},{"className":298},[],[300],{"type":49,"value":301},"logs-*",{"type":49,"value":303},"\"), break\nthe request into discrete tasks before executing. Follow this workflow:",{"type":43,"tag":305,"props":306,"children":308},"h3",{"id":307},"step-1-identify-the-components",[309],{"type":49,"value":310},"Step 1 — Identify the components",{"type":43,"tag":52,"props":312,"children":313},{},[314],{"type":49,"value":315},"Extract from the prompt:",{"type":43,"tag":174,"props":317,"children":318},{},[319,335],{"type":43,"tag":178,"props":320,"children":321},{},[322],{"type":43,"tag":182,"props":323,"children":324},{},[325,330],{"type":43,"tag":186,"props":326,"children":327},{},[328],{"type":49,"value":329},"Component",{"type":43,"tag":186,"props":331,"children":332},{},[333],{"type":49,"value":334},"Question to answer",{"type":43,"tag":197,"props":336,"children":337},{},[338,354,370,386,402,418],{"type":43,"tag":182,"props":339,"children":340},{},[341,349],{"type":43,"tag":204,"props":342,"children":343},{},[344],{"type":43,"tag":63,"props":345,"children":346},{},[347],{"type":49,"value":348},"Who",{"type":43,"tag":204,"props":350,"children":351},{},[352],{"type":49,"value":353},"New native user, existing user, or external realm user (LDAP, SAML, etc.)",{"type":43,"tag":182,"props":355,"children":356},{},[357,365],{"type":43,"tag":204,"props":358,"children":359},{},[360],{"type":43,"tag":63,"props":361,"children":362},{},[363],{"type":49,"value":364},"What",{"type":43,"tag":204,"props":366,"children":367},{},[368],{"type":49,"value":369},"Which indices, data streams, or Kibana features",{"type":43,"tag":182,"props":371,"children":372},{},[373,381],{"type":43,"tag":204,"props":374,"children":375},{},[376],{"type":43,"tag":63,"props":377,"children":378},{},[379],{"type":49,"value":380},"Access level",{"type":43,"tag":204,"props":382,"children":383},{},[384],{"type":49,"value":385},"Read, write, manage, or a specific set of privileges",{"type":43,"tag":182,"props":387,"children":388},{},[389,397],{"type":43,"tag":204,"props":390,"children":391},{},[392],{"type":43,"tag":63,"props":393,"children":394},{},[395],{"type":49,"value":396},"Scope",{"type":43,"tag":204,"props":398,"children":399},{},[400],{"type":49,"value":401},"All documents\u002Ffields, or restricted by region, department, sensitivity?",{"type":43,"tag":182,"props":403,"children":404},{},[405,413],{"type":43,"tag":204,"props":406,"children":407},{},[408],{"type":43,"tag":63,"props":409,"children":410},{},[411],{"type":49,"value":412},"Kibana?",{"type":43,"tag":204,"props":414,"children":415},{},[416],{"type":49,"value":417},"Does the request mention any Kibana feature (dashboards, Discover, etc.)",{"type":43,"tag":182,"props":419,"children":420},{},[421,429],{"type":43,"tag":204,"props":422,"children":423},{},[424],{"type":43,"tag":63,"props":425,"children":426},{},[427],{"type":49,"value":428},"Deployment?",{"type":43,"tag":204,"props":430,"children":431},{},[432],{"type":49,"value":433},"Self-managed, ECH, or Serverless? Serverless has a different user model.",{"type":43,"tag":305,"props":435,"children":437},{"id":436},"step-2-check-for-existing-roles",[438],{"type":49,"value":439},"Step 2 — Check for existing roles",{"type":43,"tag":52,"props":441,"children":442},{},[443],{"type":49,"value":444},"Before creating a new role, check if an existing role already grants the required access:",{"type":43,"tag":446,"props":447,"children":452},"pre",{"className":448,"code":449,"language":450,"meta":451,"style":451},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\" \u003Cauth_flags>\n","bash","",[453],{"type":43,"tag":218,"props":454,"children":455},{"__ignoreMap":451},[456],{"type":43,"tag":457,"props":458,"children":461},"span",{"class":459,"line":460},"line",1,[462,468,474,480,485,491,496,501,506,511],{"type":43,"tag":457,"props":463,"children":465},{"style":464},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[466],{"type":49,"value":467},"curl",{"type":43,"tag":457,"props":469,"children":471},{"style":470},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[472],{"type":49,"value":473}," \"${",{"type":43,"tag":457,"props":475,"children":477},{"style":476},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[478],{"type":49,"value":479},"ELASTICSEARCH_URL",{"type":43,"tag":457,"props":481,"children":482},{"style":470},[483],{"type":49,"value":484},"}",{"type":43,"tag":457,"props":486,"children":488},{"style":487},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[489],{"type":49,"value":490},"\u002F_security\u002Frole",{"type":43,"tag":457,"props":492,"children":493},{"style":470},[494],{"type":49,"value":495},"\"",{"type":43,"tag":457,"props":497,"children":498},{"style":470},[499],{"type":49,"value":500}," \u003C",{"type":43,"tag":457,"props":502,"children":503},{"style":487},[504],{"type":49,"value":505},"auth_flag",{"type":43,"tag":457,"props":507,"children":508},{"style":476},[509],{"type":49,"value":510},"s",{"type":43,"tag":457,"props":512,"children":513},{"style":470},[514],{"type":49,"value":515},">\n",{"type":43,"tag":52,"props":517,"children":518},{},[519],{"type":49,"value":520},"If a matching role exists, skip role creation and reuse it.",{"type":43,"tag":305,"props":522,"children":524},{"id":523},"step-3-create-the-role-if-needed",[525],{"type":49,"value":526},"Step 3 — Create the role (if needed)",{"type":43,"tag":52,"props":528,"children":529},{},[530,532,538],{"type":49,"value":531},"Derive a role name and display name from the request. Use the Elasticsearch API for pure index\u002Fcluster roles. Use the\nKibana API if Kibana features are involved (see ",{"type":43,"tag":76,"props":533,"children":535},{"href":534},"#choosing-the-right-api",[536],{"type":49,"value":537},"Choosing the right API",{"type":49,"value":539},").",{"type":43,"tag":305,"props":541,"children":543},{"id":542},"step-4-create-or-update-the-user",[544],{"type":49,"value":545},"Step 4 — Create or update the user",{"type":43,"tag":174,"props":547,"children":548},{},[549,565],{"type":43,"tag":178,"props":550,"children":551},{},[552],{"type":43,"tag":182,"props":553,"children":554},{},[555,560],{"type":43,"tag":186,"props":556,"children":557},{},[558],{"type":49,"value":559},"Scenario",{"type":43,"tag":186,"props":561,"children":562},{},[563],{"type":49,"value":564},"Action",{"type":43,"tag":197,"props":566,"children":567},{},[568,584,600,616],{"type":43,"tag":182,"props":569,"children":570},{},[571,579],{"type":43,"tag":204,"props":572,"children":573},{},[574],{"type":43,"tag":63,"props":575,"children":576},{},[577],{"type":49,"value":578},"New native user",{"type":43,"tag":204,"props":580,"children":581},{},[582],{"type":49,"value":583},"Create the user with the role and a strong generated password. (Self-managed \u002F ECH only.)",{"type":43,"tag":182,"props":585,"children":586},{},[587,595],{"type":43,"tag":204,"props":588,"children":589},{},[590],{"type":43,"tag":63,"props":591,"children":592},{},[593],{"type":49,"value":594},"Existing native user",{"type":43,"tag":204,"props":596,"children":597},{},[598],{"type":49,"value":599},"Fetch current roles, append the new role, update the user with the full array. (Self-managed \u002F ECH only.)",{"type":43,"tag":182,"props":601,"children":602},{},[603,611],{"type":43,"tag":204,"props":604,"children":605},{},[606],{"type":43,"tag":63,"props":607,"children":608},{},[609],{"type":49,"value":610},"External realm user",{"type":43,"tag":204,"props":612,"children":613},{},[614],{"type":49,"value":615},"Create a role mapping that matches the user's realm attributes to the role. (Self-managed \u002F ECH only.)",{"type":43,"tag":182,"props":617,"children":618},{},[619,627],{"type":43,"tag":204,"props":620,"children":621},{},[622],{"type":43,"tag":63,"props":623,"children":624},{},[625],{"type":49,"value":626},"Serverless user",{"type":43,"tag":204,"props":628,"children":629},{},[630,632,637],{"type":49,"value":631},"Use the ",{"type":43,"tag":63,"props":633,"children":634},{},[635],{"type":49,"value":636},"cloud-access-management",{"type":49,"value":638}," skill. Assign a predefined role or create a custom role first, then assign it via the Cloud API.",{"type":43,"tag":305,"props":640,"children":642},{"id":641},"example-decomposition",[643],{"type":49,"value":644},"Example decomposition",{"type":43,"tag":52,"props":646,"children":647},{},[648,653,655,661,663,668,670,676],{"type":43,"tag":63,"props":649,"children":650},{},[651],{"type":49,"value":652},"Prompt:",{"type":49,"value":654}," \"Create a user ",{"type":43,"tag":218,"props":656,"children":658},{"className":657},[],[659],{"type":49,"value":660},"analyst",{"type":49,"value":662}," with read-only access to ",{"type":43,"tag":218,"props":664,"children":666},{"className":665},[],[667],{"type":49,"value":301},{"type":49,"value":669}," and ",{"type":43,"tag":218,"props":671,"children":673},{"className":672},[],[674],{"type":49,"value":675},"metrics-*",{"type":49,"value":677}," and view dashboards in Kibana.\"",{"type":43,"tag":679,"props":680,"children":681},"ol",{},[682,708,721,733],{"type":43,"tag":117,"props":683,"children":684},{},[685,687,692,694,699,701,706],{"type":49,"value":686},"Identify: new user ",{"type":43,"tag":218,"props":688,"children":690},{"className":689},[],[691],{"type":49,"value":660},{"type":49,"value":693},", indices ",{"type":43,"tag":218,"props":695,"children":697},{"className":696},[],[698],{"type":49,"value":301},{"type":49,"value":700},"\u002F",{"type":43,"tag":218,"props":702,"children":704},{"className":703},[],[705],{"type":49,"value":675},{"type":49,"value":707},", dashboards, read access.",{"type":43,"tag":117,"props":709,"children":710},{},[711,713,719],{"type":49,"value":712},"Check roles: ",{"type":43,"tag":218,"props":714,"children":716},{"className":715},[],[717],{"type":49,"value":718},"GET \u002F_security\u002Frole",{"type":49,"value":720}," — no match.",{"type":43,"tag":117,"props":722,"children":723},{},[724,726,732],{"type":49,"value":725},"Create role via Kibana API (dashboards involved): ",{"type":43,"tag":218,"props":727,"children":729},{"className":728},[],[730],{"type":49,"value":731},"logs-metrics-dashboard-viewer",{"type":49,"value":82},{"type":43,"tag":117,"props":734,"children":735},{},[736,738,744,746,752],{"type":49,"value":737},"Create user: ",{"type":43,"tag":218,"props":739,"children":741},{"className":740},[],[742],{"type":49,"value":743},"POST \u002F_security\u002Fuser\u002Fanalyst",{"type":49,"value":745}," with ",{"type":43,"tag":218,"props":747,"children":749},{"className":748},[],[750],{"type":49,"value":751},"roles: [\"logs-metrics-dashboard-viewer\"]",{"type":49,"value":82},{"type":43,"tag":52,"props":754,"children":755},{},[756],{"type":49,"value":757},"Confirm each step with the user if the request is ambiguous.",{"type":43,"tag":106,"props":759,"children":761},{"id":760},"manage-native-users",[762],{"type":49,"value":763},"Manage Native Users",{"type":43,"tag":84,"props":765,"children":766},{},[767],{"type":43,"tag":52,"props":768,"children":769},{},[770],{"type":49,"value":771},"Native user management applies to self-managed and ECH deployments. On Serverless, users are managed at the\norganization level — skip this section.",{"type":43,"tag":305,"props":773,"children":775},{"id":774},"create-a-user",[776],{"type":49,"value":777},"Create a user",{"type":43,"tag":446,"props":779,"children":781},{"className":448,"code":780,"language":450,"meta":451,"style":451},"curl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"password\": \"'\"${PASSWORD}\"'\",\n    \"roles\": [\"'\"${ROLE_NAME}\"'\"],\n    \"full_name\": \"'\"${FULL_NAME}\"'\",\n    \"email\": \"'\"${EMAIL}\"'\",\n    \"enabled\": true\n  }'\n",[782],{"type":43,"tag":218,"props":783,"children":784},{"__ignoreMap":451},[785,839,865,892,911,940,967,993,1019,1028],{"type":43,"tag":457,"props":786,"children":787},{"class":459,"line":460},[788,792,797,802,806,810,814,819,824,829,834],{"type":43,"tag":457,"props":789,"children":790},{"style":464},[791],{"type":49,"value":467},{"type":43,"tag":457,"props":793,"children":794},{"style":487},[795],{"type":49,"value":796}," -X",{"type":43,"tag":457,"props":798,"children":799},{"style":487},[800],{"type":49,"value":801}," POST",{"type":43,"tag":457,"props":803,"children":804},{"style":470},[805],{"type":49,"value":473},{"type":43,"tag":457,"props":807,"children":808},{"style":476},[809],{"type":49,"value":479},{"type":43,"tag":457,"props":811,"children":812},{"style":470},[813],{"type":49,"value":484},{"type":43,"tag":457,"props":815,"children":816},{"style":487},[817],{"type":49,"value":818},"\u002F_security\u002Fuser\u002F",{"type":43,"tag":457,"props":820,"children":821},{"style":470},[822],{"type":49,"value":823},"${",{"type":43,"tag":457,"props":825,"children":826},{"style":476},[827],{"type":49,"value":828},"USERNAME",{"type":43,"tag":457,"props":830,"children":831},{"style":470},[832],{"type":49,"value":833},"}\"",{"type":43,"tag":457,"props":835,"children":836},{"style":476},[837],{"type":49,"value":838}," \\\n",{"type":43,"tag":457,"props":840,"children":842},{"class":459,"line":841},2,[843,848,852,856,861],{"type":43,"tag":457,"props":844,"children":845},{"style":470},[846],{"type":49,"value":847},"  \u003C",{"type":43,"tag":457,"props":849,"children":850},{"style":487},[851],{"type":49,"value":505},{"type":43,"tag":457,"props":853,"children":854},{"style":476},[855],{"type":49,"value":510},{"type":43,"tag":457,"props":857,"children":858},{"style":470},[859],{"type":49,"value":860},">",{"type":43,"tag":457,"props":862,"children":863},{"style":476},[864],{"type":49,"value":838},{"type":43,"tag":457,"props":866,"children":868},{"class":459,"line":867},3,[869,874,879,884,888],{"type":43,"tag":457,"props":870,"children":871},{"style":487},[872],{"type":49,"value":873},"  -H",{"type":43,"tag":457,"props":875,"children":876},{"style":470},[877],{"type":49,"value":878}," \"",{"type":43,"tag":457,"props":880,"children":881},{"style":487},[882],{"type":49,"value":883},"Content-Type: application\u002Fjson",{"type":43,"tag":457,"props":885,"children":886},{"style":470},[887],{"type":49,"value":495},{"type":43,"tag":457,"props":889,"children":890},{"style":476},[891],{"type":49,"value":838},{"type":43,"tag":457,"props":893,"children":895},{"class":459,"line":894},4,[896,901,906],{"type":43,"tag":457,"props":897,"children":898},{"style":487},[899],{"type":49,"value":900},"  -d",{"type":43,"tag":457,"props":902,"children":903},{"style":470},[904],{"type":49,"value":905}," '",{"type":43,"tag":457,"props":907,"children":908},{"style":487},[909],{"type":49,"value":910},"{\n",{"type":43,"tag":457,"props":912,"children":914},{"class":459,"line":913},5,[915,920,925,930,935],{"type":43,"tag":457,"props":916,"children":917},{"style":487},[918],{"type":49,"value":919},"    \"password\": \"",{"type":43,"tag":457,"props":921,"children":922},{"style":470},[923],{"type":49,"value":924},"'\"${",{"type":43,"tag":457,"props":926,"children":927},{"style":476},[928],{"type":49,"value":929},"PASSWORD",{"type":43,"tag":457,"props":931,"children":932},{"style":470},[933],{"type":49,"value":934},"}\"'",{"type":43,"tag":457,"props":936,"children":937},{"style":487},[938],{"type":49,"value":939},"\",\n",{"type":43,"tag":457,"props":941,"children":943},{"class":459,"line":942},6,[944,949,953,958,962],{"type":43,"tag":457,"props":945,"children":946},{"style":487},[947],{"type":49,"value":948},"    \"roles\": [\"",{"type":43,"tag":457,"props":950,"children":951},{"style":470},[952],{"type":49,"value":924},{"type":43,"tag":457,"props":954,"children":955},{"style":476},[956],{"type":49,"value":957},"ROLE_NAME",{"type":43,"tag":457,"props":959,"children":960},{"style":470},[961],{"type":49,"value":934},{"type":43,"tag":457,"props":963,"children":964},{"style":487},[965],{"type":49,"value":966},"\"],\n",{"type":43,"tag":457,"props":968,"children":970},{"class":459,"line":969},7,[971,976,980,985,989],{"type":43,"tag":457,"props":972,"children":973},{"style":487},[974],{"type":49,"value":975},"    \"full_name\": \"",{"type":43,"tag":457,"props":977,"children":978},{"style":470},[979],{"type":49,"value":924},{"type":43,"tag":457,"props":981,"children":982},{"style":476},[983],{"type":49,"value":984},"FULL_NAME",{"type":43,"tag":457,"props":986,"children":987},{"style":470},[988],{"type":49,"value":934},{"type":43,"tag":457,"props":990,"children":991},{"style":487},[992],{"type":49,"value":939},{"type":43,"tag":457,"props":994,"children":996},{"class":459,"line":995},8,[997,1002,1006,1011,1015],{"type":43,"tag":457,"props":998,"children":999},{"style":487},[1000],{"type":49,"value":1001},"    \"email\": \"",{"type":43,"tag":457,"props":1003,"children":1004},{"style":470},[1005],{"type":49,"value":924},{"type":43,"tag":457,"props":1007,"children":1008},{"style":476},[1009],{"type":49,"value":1010},"EMAIL",{"type":43,"tag":457,"props":1012,"children":1013},{"style":470},[1014],{"type":49,"value":934},{"type":43,"tag":457,"props":1016,"children":1017},{"style":487},[1018],{"type":49,"value":939},{"type":43,"tag":457,"props":1020,"children":1022},{"class":459,"line":1021},9,[1023],{"type":43,"tag":457,"props":1024,"children":1025},{"style":487},[1026],{"type":49,"value":1027},"    \"enabled\": true\n",{"type":43,"tag":457,"props":1029,"children":1031},{"class":459,"line":1030},10,[1032,1037],{"type":43,"tag":457,"props":1033,"children":1034},{"style":487},[1035],{"type":49,"value":1036},"  }",{"type":43,"tag":457,"props":1038,"children":1039},{"style":470},[1040],{"type":49,"value":1041},"'\n",{"type":43,"tag":305,"props":1043,"children":1045},{"id":1044},"update-a-user",[1046],{"type":49,"value":1047},"Update a user",{"type":43,"tag":52,"props":1049,"children":1050},{},[1051,1053,1059,1061,1067],{"type":49,"value":1052},"Use ",{"type":43,"tag":218,"props":1054,"children":1056},{"className":1055},[],[1057],{"type":49,"value":1058},"PUT \u002F_security\u002Fuser\u002F${USERNAME}",{"type":49,"value":1060}," with the fields to change. Omit ",{"type":43,"tag":218,"props":1062,"children":1064},{"className":1063},[],[1065],{"type":49,"value":1066},"password",{"type":49,"value":1068}," to keep the existing one.",{"type":43,"tag":305,"props":1070,"children":1072},{"id":1071},"other-user-operations",[1073],{"type":49,"value":1074},"Other user operations",{"type":43,"tag":446,"props":1076,"children":1078},{"className":448,"code":1077,"language":450,"meta":451,"style":451},"curl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\u002F_password\" \\\n  \u003Cauth_flags> -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"password\": \"'\"${NEW_PASSWORD}\"'\"}'\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\u002F_disable\" \u003Cauth_flags>\ncurl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\u002F_enable\" \u003Cauth_flags>\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\" \u003Cauth_flags>\ncurl -X DELETE \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\" \u003Cauth_flags>\n",[1079],{"type":43,"tag":218,"props":1080,"children":1081},{"__ignoreMap":451},[1082,1138,1178,1216,1285,1353,1404],{"type":43,"tag":457,"props":1083,"children":1084},{"class":459,"line":460},[1085,1089,1093,1097,1101,1105,1109,1113,1117,1121,1125,1130,1134],{"type":43,"tag":457,"props":1086,"children":1087},{"style":464},[1088],{"type":49,"value":467},{"type":43,"tag":457,"props":1090,"children":1091},{"style":487},[1092],{"type":49,"value":796},{"type":43,"tag":457,"props":1094,"children":1095},{"style":487},[1096],{"type":49,"value":801},{"type":43,"tag":457,"props":1098,"children":1099},{"style":470},[1100],{"type":49,"value":473},{"type":43,"tag":457,"props":1102,"children":1103},{"style":476},[1104],{"type":49,"value":479},{"type":43,"tag":457,"props":1106,"children":1107},{"style":470},[1108],{"type":49,"value":484},{"type":43,"tag":457,"props":1110,"children":1111},{"style":487},[1112],{"type":49,"value":818},{"type":43,"tag":457,"props":1114,"children":1115},{"style":470},[1116],{"type":49,"value":823},{"type":43,"tag":457,"props":1118,"children":1119},{"style":476},[1120],{"type":49,"value":828},{"type":43,"tag":457,"props":1122,"children":1123},{"style":470},[1124],{"type":49,"value":484},{"type":43,"tag":457,"props":1126,"children":1127},{"style":487},[1128],{"type":49,"value":1129},"\u002F_password",{"type":43,"tag":457,"props":1131,"children":1132},{"style":470},[1133],{"type":49,"value":495},{"type":43,"tag":457,"props":1135,"children":1136},{"style":476},[1137],{"type":49,"value":838},{"type":43,"tag":457,"props":1139,"children":1140},{"class":459,"line":841},[1141,1145,1149,1153,1157,1162,1166,1170,1174],{"type":43,"tag":457,"props":1142,"children":1143},{"style":470},[1144],{"type":49,"value":847},{"type":43,"tag":457,"props":1146,"children":1147},{"style":487},[1148],{"type":49,"value":505},{"type":43,"tag":457,"props":1150,"children":1151},{"style":476},[1152],{"type":49,"value":510},{"type":43,"tag":457,"props":1154,"children":1155},{"style":470},[1156],{"type":49,"value":860},{"type":43,"tag":457,"props":1158,"children":1159},{"style":487},[1160],{"type":49,"value":1161}," -H",{"type":43,"tag":457,"props":1163,"children":1164},{"style":470},[1165],{"type":49,"value":878},{"type":43,"tag":457,"props":1167,"children":1168},{"style":487},[1169],{"type":49,"value":883},{"type":43,"tag":457,"props":1171,"children":1172},{"style":470},[1173],{"type":49,"value":495},{"type":43,"tag":457,"props":1175,"children":1176},{"style":476},[1177],{"type":49,"value":838},{"type":43,"tag":457,"props":1179,"children":1180},{"class":459,"line":867},[1181,1185,1189,1194,1198,1203,1207,1212],{"type":43,"tag":457,"props":1182,"children":1183},{"style":487},[1184],{"type":49,"value":900},{"type":43,"tag":457,"props":1186,"children":1187},{"style":470},[1188],{"type":49,"value":905},{"type":43,"tag":457,"props":1190,"children":1191},{"style":487},[1192],{"type":49,"value":1193},"{\"password\": \"",{"type":43,"tag":457,"props":1195,"children":1196},{"style":470},[1197],{"type":49,"value":924},{"type":43,"tag":457,"props":1199,"children":1200},{"style":476},[1201],{"type":49,"value":1202},"NEW_PASSWORD",{"type":43,"tag":457,"props":1204,"children":1205},{"style":470},[1206],{"type":49,"value":934},{"type":43,"tag":457,"props":1208,"children":1209},{"style":487},[1210],{"type":49,"value":1211},"\"}",{"type":43,"tag":457,"props":1213,"children":1214},{"style":470},[1215],{"type":49,"value":1041},{"type":43,"tag":457,"props":1217,"children":1218},{"class":459,"line":894},[1219,1223,1227,1232,1236,1240,1244,1248,1252,1256,1260,1265,1269,1273,1277,1281],{"type":43,"tag":457,"props":1220,"children":1221},{"style":464},[1222],{"type":49,"value":467},{"type":43,"tag":457,"props":1224,"children":1225},{"style":487},[1226],{"type":49,"value":796},{"type":43,"tag":457,"props":1228,"children":1229},{"style":487},[1230],{"type":49,"value":1231}," PUT",{"type":43,"tag":457,"props":1233,"children":1234},{"style":470},[1235],{"type":49,"value":473},{"type":43,"tag":457,"props":1237,"children":1238},{"style":476},[1239],{"type":49,"value":479},{"type":43,"tag":457,"props":1241,"children":1242},{"style":470},[1243],{"type":49,"value":484},{"type":43,"tag":457,"props":1245,"children":1246},{"style":487},[1247],{"type":49,"value":818},{"type":43,"tag":457,"props":1249,"children":1250},{"style":470},[1251],{"type":49,"value":823},{"type":43,"tag":457,"props":1253,"children":1254},{"style":476},[1255],{"type":49,"value":828},{"type":43,"tag":457,"props":1257,"children":1258},{"style":470},[1259],{"type":49,"value":484},{"type":43,"tag":457,"props":1261,"children":1262},{"style":487},[1263],{"type":49,"value":1264},"\u002F_disable",{"type":43,"tag":457,"props":1266,"children":1267},{"style":470},[1268],{"type":49,"value":495},{"type":43,"tag":457,"props":1270,"children":1271},{"style":470},[1272],{"type":49,"value":500},{"type":43,"tag":457,"props":1274,"children":1275},{"style":487},[1276],{"type":49,"value":505},{"type":43,"tag":457,"props":1278,"children":1279},{"style":476},[1280],{"type":49,"value":510},{"type":43,"tag":457,"props":1282,"children":1283},{"style":470},[1284],{"type":49,"value":515},{"type":43,"tag":457,"props":1286,"children":1287},{"class":459,"line":913},[1288,1292,1296,1300,1304,1308,1312,1316,1320,1324,1328,1333,1337,1341,1345,1349],{"type":43,"tag":457,"props":1289,"children":1290},{"style":464},[1291],{"type":49,"value":467},{"type":43,"tag":457,"props":1293,"children":1294},{"style":487},[1295],{"type":49,"value":796},{"type":43,"tag":457,"props":1297,"children":1298},{"style":487},[1299],{"type":49,"value":1231},{"type":43,"tag":457,"props":1301,"children":1302},{"style":470},[1303],{"type":49,"value":473},{"type":43,"tag":457,"props":1305,"children":1306},{"style":476},[1307],{"type":49,"value":479},{"type":43,"tag":457,"props":1309,"children":1310},{"style":470},[1311],{"type":49,"value":484},{"type":43,"tag":457,"props":1313,"children":1314},{"style":487},[1315],{"type":49,"value":818},{"type":43,"tag":457,"props":1317,"children":1318},{"style":470},[1319],{"type":49,"value":823},{"type":43,"tag":457,"props":1321,"children":1322},{"style":476},[1323],{"type":49,"value":828},{"type":43,"tag":457,"props":1325,"children":1326},{"style":470},[1327],{"type":49,"value":484},{"type":43,"tag":457,"props":1329,"children":1330},{"style":487},[1331],{"type":49,"value":1332},"\u002F_enable",{"type":43,"tag":457,"props":1334,"children":1335},{"style":470},[1336],{"type":49,"value":495},{"type":43,"tag":457,"props":1338,"children":1339},{"style":470},[1340],{"type":49,"value":500},{"type":43,"tag":457,"props":1342,"children":1343},{"style":487},[1344],{"type":49,"value":505},{"type":43,"tag":457,"props":1346,"children":1347},{"style":476},[1348],{"type":49,"value":510},{"type":43,"tag":457,"props":1350,"children":1351},{"style":470},[1352],{"type":49,"value":515},{"type":43,"tag":457,"props":1354,"children":1355},{"class":459,"line":942},[1356,1360,1364,1368,1372,1376,1380,1384,1388,1392,1396,1400],{"type":43,"tag":457,"props":1357,"children":1358},{"style":464},[1359],{"type":49,"value":467},{"type":43,"tag":457,"props":1361,"children":1362},{"style":470},[1363],{"type":49,"value":473},{"type":43,"tag":457,"props":1365,"children":1366},{"style":476},[1367],{"type":49,"value":479},{"type":43,"tag":457,"props":1369,"children":1370},{"style":470},[1371],{"type":49,"value":484},{"type":43,"tag":457,"props":1373,"children":1374},{"style":487},[1375],{"type":49,"value":818},{"type":43,"tag":457,"props":1377,"children":1378},{"style":470},[1379],{"type":49,"value":823},{"type":43,"tag":457,"props":1381,"children":1382},{"style":476},[1383],{"type":49,"value":828},{"type":43,"tag":457,"props":1385,"children":1386},{"style":470},[1387],{"type":49,"value":833},{"type":43,"tag":457,"props":1389,"children":1390},{"style":470},[1391],{"type":49,"value":500},{"type":43,"tag":457,"props":1393,"children":1394},{"style":487},[1395],{"type":49,"value":505},{"type":43,"tag":457,"props":1397,"children":1398},{"style":476},[1399],{"type":49,"value":510},{"type":43,"tag":457,"props":1401,"children":1402},{"style":470},[1403],{"type":49,"value":515},{"type":43,"tag":457,"props":1405,"children":1406},{"class":459,"line":969},[1407,1411,1415,1420,1424,1428,1432,1436,1440,1444,1448,1452,1456,1460],{"type":43,"tag":457,"props":1408,"children":1409},{"style":464},[1410],{"type":49,"value":467},{"type":43,"tag":457,"props":1412,"children":1413},{"style":487},[1414],{"type":49,"value":796},{"type":43,"tag":457,"props":1416,"children":1417},{"style":487},[1418],{"type":49,"value":1419}," DELETE",{"type":43,"tag":457,"props":1421,"children":1422},{"style":470},[1423],{"type":49,"value":473},{"type":43,"tag":457,"props":1425,"children":1426},{"style":476},[1427],{"type":49,"value":479},{"type":43,"tag":457,"props":1429,"children":1430},{"style":470},[1431],{"type":49,"value":484},{"type":43,"tag":457,"props":1433,"children":1434},{"style":487},[1435],{"type":49,"value":818},{"type":43,"tag":457,"props":1437,"children":1438},{"style":470},[1439],{"type":49,"value":823},{"type":43,"tag":457,"props":1441,"children":1442},{"style":476},[1443],{"type":49,"value":828},{"type":43,"tag":457,"props":1445,"children":1446},{"style":470},[1447],{"type":49,"value":833},{"type":43,"tag":457,"props":1449,"children":1450},{"style":470},[1451],{"type":49,"value":500},{"type":43,"tag":457,"props":1453,"children":1454},{"style":487},[1455],{"type":49,"value":505},{"type":43,"tag":457,"props":1457,"children":1458},{"style":476},[1459],{"type":49,"value":510},{"type":43,"tag":457,"props":1461,"children":1462},{"style":470},[1463],{"type":49,"value":515},{"type":43,"tag":106,"props":1465,"children":1467},{"id":1466},"manage-roles",[1468],{"type":49,"value":1469},"Manage Roles",{"type":43,"tag":305,"props":1471,"children":1473},{"id":1472},"choosing-the-right-api",[1474],{"type":49,"value":537},{"type":43,"tag":52,"props":1476,"children":1477},{},[1478,1479,1484,1486,1492,1494,1500,1501,1507],{"type":49,"value":631},{"type":43,"tag":63,"props":1480,"children":1481},{},[1482],{"type":49,"value":1483},"Elasticsearch API",{"type":49,"value":1485}," (",{"type":43,"tag":218,"props":1487,"children":1489},{"className":1488},[],[1490],{"type":49,"value":1491},"PUT \u002F_security\u002Frole\u002F{name}",{"type":49,"value":1493},") when the role only needs ",{"type":43,"tag":218,"props":1495,"children":1497},{"className":1496},[],[1498],{"type":49,"value":1499},"cluster",{"type":49,"value":669},{"type":43,"tag":218,"props":1502,"children":1504},{"className":1503},[],[1505],{"type":49,"value":1506},"indices",{"type":49,"value":1508},"\nprivileges. This is the default — no Kibana endpoint is required.",{"type":43,"tag":52,"props":1510,"children":1511},{},[1512,1513,1518,1519,1525],{"type":49,"value":631},{"type":43,"tag":63,"props":1514,"children":1515},{},[1516],{"type":49,"value":1517},"Kibana role API",{"type":49,"value":1485},{"type":43,"tag":218,"props":1520,"children":1522},{"className":1521},[],[1523],{"type":49,"value":1524},"PUT \u002Fapi\u002Fsecurity\u002Frole\u002F{name}",{"type":49,"value":1526},") when the role includes any Kibana feature or space\nprivileges. The Elasticsearch API cannot set Kibana feature grants, space scoping, or base privileges, so if the user\nmentions Kibana features like Discover, Dashboards, Maps, Visualize, Canvas, or any other Kibana application, the Kibana\nAPI is required.",{"type":43,"tag":52,"props":1528,"children":1529},{},[1530,1532,1537,1538,1543],{"type":49,"value":1531},"If the Kibana endpoint is not available or API key authentication to Kibana fails, fall back to the Elasticsearch API\nfor the ",{"type":43,"tag":218,"props":1533,"children":1535},{"className":1534},[],[1536],{"type":49,"value":1499},{"type":49,"value":669},{"type":43,"tag":218,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":49,"value":1506},{"type":49,"value":1544}," portion and warn the user that Kibana privileges could not be set. Prompt for a Kibana\nURL or alternative credentials before giving up.",{"type":43,"tag":305,"props":1546,"children":1548},{"id":1547},"create-or-update-a-role-elasticsearch-api",[1549],{"type":49,"value":1550},"Create or update a role (Elasticsearch API)",{"type":43,"tag":52,"props":1552,"children":1553},{},[1554],{"type":49,"value":1555},"Default choice when the role has only index and cluster privileges:",{"type":43,"tag":446,"props":1557,"children":1559},{"className":448,"code":1558,"language":450,"meta":451,"style":451},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002F${ROLE_NAME}\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"'\"${ROLE_DISPLAY_NAME}\"'\",\n    \"cluster\": [],\n    \"indices\": [\n      {\n        \"names\": [\"'\"${INDEX_PATTERN}\"'\"],\n        \"privileges\": [\"read\", \"view_index_metadata\"]\n      }\n    ]\n  }'\n",[1560],{"type":43,"tag":218,"props":1561,"children":1562},{"__ignoreMap":451},[1563,1611,1634,1657,1672,1697,1705,1713,1721,1746,1754,1763,1772],{"type":43,"tag":457,"props":1564,"children":1565},{"class":459,"line":460},[1566,1570,1574,1578,1582,1586,1590,1595,1599,1603,1607],{"type":43,"tag":457,"props":1567,"children":1568},{"style":464},[1569],{"type":49,"value":467},{"type":43,"tag":457,"props":1571,"children":1572},{"style":487},[1573],{"type":49,"value":796},{"type":43,"tag":457,"props":1575,"children":1576},{"style":487},[1577],{"type":49,"value":1231},{"type":43,"tag":457,"props":1579,"children":1580},{"style":470},[1581],{"type":49,"value":473},{"type":43,"tag":457,"props":1583,"children":1584},{"style":476},[1585],{"type":49,"value":479},{"type":43,"tag":457,"props":1587,"children":1588},{"style":470},[1589],{"type":49,"value":484},{"type":43,"tag":457,"props":1591,"children":1592},{"style":487},[1593],{"type":49,"value":1594},"\u002F_security\u002Frole\u002F",{"type":43,"tag":457,"props":1596,"children":1597},{"style":470},[1598],{"type":49,"value":823},{"type":43,"tag":457,"props":1600,"children":1601},{"style":476},[1602],{"type":49,"value":957},{"type":43,"tag":457,"props":1604,"children":1605},{"style":470},[1606],{"type":49,"value":833},{"type":43,"tag":457,"props":1608,"children":1609},{"style":476},[1610],{"type":49,"value":838},{"type":43,"tag":457,"props":1612,"children":1613},{"class":459,"line":841},[1614,1618,1622,1626,1630],{"type":43,"tag":457,"props":1615,"children":1616},{"style":470},[1617],{"type":49,"value":847},{"type":43,"tag":457,"props":1619,"children":1620},{"style":487},[1621],{"type":49,"value":505},{"type":43,"tag":457,"props":1623,"children":1624},{"style":476},[1625],{"type":49,"value":510},{"type":43,"tag":457,"props":1627,"children":1628},{"style":470},[1629],{"type":49,"value":860},{"type":43,"tag":457,"props":1631,"children":1632},{"style":476},[1633],{"type":49,"value":838},{"type":43,"tag":457,"props":1635,"children":1636},{"class":459,"line":867},[1637,1641,1645,1649,1653],{"type":43,"tag":457,"props":1638,"children":1639},{"style":487},[1640],{"type":49,"value":873},{"type":43,"tag":457,"props":1642,"children":1643},{"style":470},[1644],{"type":49,"value":878},{"type":43,"tag":457,"props":1646,"children":1647},{"style":487},[1648],{"type":49,"value":883},{"type":43,"tag":457,"props":1650,"children":1651},{"style":470},[1652],{"type":49,"value":495},{"type":43,"tag":457,"props":1654,"children":1655},{"style":476},[1656],{"type":49,"value":838},{"type":43,"tag":457,"props":1658,"children":1659},{"class":459,"line":894},[1660,1664,1668],{"type":43,"tag":457,"props":1661,"children":1662},{"style":487},[1663],{"type":49,"value":900},{"type":43,"tag":457,"props":1665,"children":1666},{"style":470},[1667],{"type":49,"value":905},{"type":43,"tag":457,"props":1669,"children":1670},{"style":487},[1671],{"type":49,"value":910},{"type":43,"tag":457,"props":1673,"children":1674},{"class":459,"line":913},[1675,1680,1684,1689,1693],{"type":43,"tag":457,"props":1676,"children":1677},{"style":487},[1678],{"type":49,"value":1679},"    \"description\": \"",{"type":43,"tag":457,"props":1681,"children":1682},{"style":470},[1683],{"type":49,"value":924},{"type":43,"tag":457,"props":1685,"children":1686},{"style":476},[1687],{"type":49,"value":1688},"ROLE_DISPLAY_NAME",{"type":43,"tag":457,"props":1690,"children":1691},{"style":470},[1692],{"type":49,"value":934},{"type":43,"tag":457,"props":1694,"children":1695},{"style":487},[1696],{"type":49,"value":939},{"type":43,"tag":457,"props":1698,"children":1699},{"class":459,"line":942},[1700],{"type":43,"tag":457,"props":1701,"children":1702},{"style":487},[1703],{"type":49,"value":1704},"    \"cluster\": [],\n",{"type":43,"tag":457,"props":1706,"children":1707},{"class":459,"line":969},[1708],{"type":43,"tag":457,"props":1709,"children":1710},{"style":487},[1711],{"type":49,"value":1712},"    \"indices\": [\n",{"type":43,"tag":457,"props":1714,"children":1715},{"class":459,"line":995},[1716],{"type":43,"tag":457,"props":1717,"children":1718},{"style":487},[1719],{"type":49,"value":1720},"      {\n",{"type":43,"tag":457,"props":1722,"children":1723},{"class":459,"line":1021},[1724,1729,1733,1738,1742],{"type":43,"tag":457,"props":1725,"children":1726},{"style":487},[1727],{"type":49,"value":1728},"        \"names\": [\"",{"type":43,"tag":457,"props":1730,"children":1731},{"style":470},[1732],{"type":49,"value":924},{"type":43,"tag":457,"props":1734,"children":1735},{"style":476},[1736],{"type":49,"value":1737},"INDEX_PATTERN",{"type":43,"tag":457,"props":1739,"children":1740},{"style":470},[1741],{"type":49,"value":934},{"type":43,"tag":457,"props":1743,"children":1744},{"style":487},[1745],{"type":49,"value":966},{"type":43,"tag":457,"props":1747,"children":1748},{"class":459,"line":1030},[1749],{"type":43,"tag":457,"props":1750,"children":1751},{"style":487},[1752],{"type":49,"value":1753},"        \"privileges\": [\"read\", \"view_index_metadata\"]\n",{"type":43,"tag":457,"props":1755,"children":1757},{"class":459,"line":1756},11,[1758],{"type":43,"tag":457,"props":1759,"children":1760},{"style":487},[1761],{"type":49,"value":1762},"      }\n",{"type":43,"tag":457,"props":1764,"children":1766},{"class":459,"line":1765},12,[1767],{"type":43,"tag":457,"props":1768,"children":1769},{"style":487},[1770],{"type":49,"value":1771},"    ]\n",{"type":43,"tag":457,"props":1773,"children":1775},{"class":459,"line":1774},13,[1776,1780],{"type":43,"tag":457,"props":1777,"children":1778},{"style":487},[1779],{"type":49,"value":1036},{"type":43,"tag":457,"props":1781,"children":1782},{"style":470},[1783],{"type":49,"value":1041},{"type":43,"tag":305,"props":1785,"children":1787},{"id":1786},"create-or-update-a-role-kibana-api",[1788],{"type":49,"value":1789},"Create or update a role (Kibana API)",{"type":43,"tag":52,"props":1791,"children":1792},{},[1793],{"type":49,"value":1794},"Required when the role includes Kibana feature or space privileges:",{"type":43,"tag":446,"props":1796,"children":1798},{"className":448,"code":1797,"language":450,"meta":451,"style":451},"curl -X PUT \"${KIBANA_URL}\u002Fapi\u002Fsecurity\u002Frole\u002F${ROLE_NAME}\" \\\n  \u003Cauth_flags> \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"'\"${ROLE_DISPLAY_NAME}\"'\",\n    \"elasticsearch\": {\n      \"cluster\": [],\n      \"indices\": [\n        {\n          \"names\": [\"'\"${INDEX_PATTERN}\"'\"],\n          \"privileges\": [\"read\", \"view_index_metadata\"]\n        }\n      ]\n    },\n    \"kibana\": [\n      {\n        \"base\": [],\n        \"feature\": {\n          \"discover\": [\"read\"],\n          \"dashboard\": [\"read\"]\n        },\n        \"spaces\": [\"*\"]\n      }\n    ]\n  }'\n",[1799],{"type":43,"tag":218,"props":1800,"children":1801},{"__ignoreMap":451},[1802,1851,1874,1898,1921,1936,1959,1967,1975,1983,1991,2015,2023,2031,2040,2049,2058,2066,2075,2084,2093,2102,2111,2120,2128,2136],{"type":43,"tag":457,"props":1803,"children":1804},{"class":459,"line":460},[1805,1809,1813,1817,1821,1826,1830,1835,1839,1843,1847],{"type":43,"tag":457,"props":1806,"children":1807},{"style":464},[1808],{"type":49,"value":467},{"type":43,"tag":457,"props":1810,"children":1811},{"style":487},[1812],{"type":49,"value":796},{"type":43,"tag":457,"props":1814,"children":1815},{"style":487},[1816],{"type":49,"value":1231},{"type":43,"tag":457,"props":1818,"children":1819},{"style":470},[1820],{"type":49,"value":473},{"type":43,"tag":457,"props":1822,"children":1823},{"style":476},[1824],{"type":49,"value":1825},"KIBANA_URL",{"type":43,"tag":457,"props":1827,"children":1828},{"style":470},[1829],{"type":49,"value":484},{"type":43,"tag":457,"props":1831,"children":1832},{"style":487},[1833],{"type":49,"value":1834},"\u002Fapi\u002Fsecurity\u002Frole\u002F",{"type":43,"tag":457,"props":1836,"children":1837},{"style":470},[1838],{"type":49,"value":823},{"type":43,"tag":457,"props":1840,"children":1841},{"style":476},[1842],{"type":49,"value":957},{"type":43,"tag":457,"props":1844,"children":1845},{"style":470},[1846],{"type":49,"value":833},{"type":43,"tag":457,"props":1848,"children":1849},{"style":476},[1850],{"type":49,"value":838},{"type":43,"tag":457,"props":1852,"children":1853},{"class":459,"line":841},[1854,1858,1862,1866,1870],{"type":43,"tag":457,"props":1855,"children":1856},{"style":470},[1857],{"type":49,"value":847},{"type":43,"tag":457,"props":1859,"children":1860},{"style":487},[1861],{"type":49,"value":505},{"type":43,"tag":457,"props":1863,"children":1864},{"style":476},[1865],{"type":49,"value":510},{"type":43,"tag":457,"props":1867,"children":1868},{"style":470},[1869],{"type":49,"value":860},{"type":43,"tag":457,"props":1871,"children":1872},{"style":476},[1873],{"type":49,"value":838},{"type":43,"tag":457,"props":1875,"children":1876},{"class":459,"line":867},[1877,1881,1885,1890,1894],{"type":43,"tag":457,"props":1878,"children":1879},{"style":487},[1880],{"type":49,"value":873},{"type":43,"tag":457,"props":1882,"children":1883},{"style":470},[1884],{"type":49,"value":878},{"type":43,"tag":457,"props":1886,"children":1887},{"style":487},[1888],{"type":49,"value":1889},"kbn-xsrf: true",{"type":43,"tag":457,"props":1891,"children":1892},{"style":470},[1893],{"type":49,"value":495},{"type":43,"tag":457,"props":1895,"children":1896},{"style":476},[1897],{"type":49,"value":838},{"type":43,"tag":457,"props":1899,"children":1900},{"class":459,"line":894},[1901,1905,1909,1913,1917],{"type":43,"tag":457,"props":1902,"children":1903},{"style":487},[1904],{"type":49,"value":873},{"type":43,"tag":457,"props":1906,"children":1907},{"style":470},[1908],{"type":49,"value":878},{"type":43,"tag":457,"props":1910,"children":1911},{"style":487},[1912],{"type":49,"value":883},{"type":43,"tag":457,"props":1914,"children":1915},{"style":470},[1916],{"type":49,"value":495},{"type":43,"tag":457,"props":1918,"children":1919},{"style":476},[1920],{"type":49,"value":838},{"type":43,"tag":457,"props":1922,"children":1923},{"class":459,"line":913},[1924,1928,1932],{"type":43,"tag":457,"props":1925,"children":1926},{"style":487},[1927],{"type":49,"value":900},{"type":43,"tag":457,"props":1929,"children":1930},{"style":470},[1931],{"type":49,"value":905},{"type":43,"tag":457,"props":1933,"children":1934},{"style":487},[1935],{"type":49,"value":910},{"type":43,"tag":457,"props":1937,"children":1938},{"class":459,"line":942},[1939,1943,1947,1951,1955],{"type":43,"tag":457,"props":1940,"children":1941},{"style":487},[1942],{"type":49,"value":1679},{"type":43,"tag":457,"props":1944,"children":1945},{"style":470},[1946],{"type":49,"value":924},{"type":43,"tag":457,"props":1948,"children":1949},{"style":476},[1950],{"type":49,"value":1688},{"type":43,"tag":457,"props":1952,"children":1953},{"style":470},[1954],{"type":49,"value":934},{"type":43,"tag":457,"props":1956,"children":1957},{"style":487},[1958],{"type":49,"value":939},{"type":43,"tag":457,"props":1960,"children":1961},{"class":459,"line":969},[1962],{"type":43,"tag":457,"props":1963,"children":1964},{"style":487},[1965],{"type":49,"value":1966},"    \"elasticsearch\": {\n",{"type":43,"tag":457,"props":1968,"children":1969},{"class":459,"line":995},[1970],{"type":43,"tag":457,"props":1971,"children":1972},{"style":487},[1973],{"type":49,"value":1974},"      \"cluster\": [],\n",{"type":43,"tag":457,"props":1976,"children":1977},{"class":459,"line":1021},[1978],{"type":43,"tag":457,"props":1979,"children":1980},{"style":487},[1981],{"type":49,"value":1982},"      \"indices\": [\n",{"type":43,"tag":457,"props":1984,"children":1985},{"class":459,"line":1030},[1986],{"type":43,"tag":457,"props":1987,"children":1988},{"style":487},[1989],{"type":49,"value":1990},"        {\n",{"type":43,"tag":457,"props":1992,"children":1993},{"class":459,"line":1756},[1994,1999,2003,2007,2011],{"type":43,"tag":457,"props":1995,"children":1996},{"style":487},[1997],{"type":49,"value":1998},"          \"names\": [\"",{"type":43,"tag":457,"props":2000,"children":2001},{"style":470},[2002],{"type":49,"value":924},{"type":43,"tag":457,"props":2004,"children":2005},{"style":476},[2006],{"type":49,"value":1737},{"type":43,"tag":457,"props":2008,"children":2009},{"style":470},[2010],{"type":49,"value":934},{"type":43,"tag":457,"props":2012,"children":2013},{"style":487},[2014],{"type":49,"value":966},{"type":43,"tag":457,"props":2016,"children":2017},{"class":459,"line":1765},[2018],{"type":43,"tag":457,"props":2019,"children":2020},{"style":487},[2021],{"type":49,"value":2022},"          \"privileges\": [\"read\", \"view_index_metadata\"]\n",{"type":43,"tag":457,"props":2024,"children":2025},{"class":459,"line":1774},[2026],{"type":43,"tag":457,"props":2027,"children":2028},{"style":487},[2029],{"type":49,"value":2030},"        }\n",{"type":43,"tag":457,"props":2032,"children":2034},{"class":459,"line":2033},14,[2035],{"type":43,"tag":457,"props":2036,"children":2037},{"style":487},[2038],{"type":49,"value":2039},"      ]\n",{"type":43,"tag":457,"props":2041,"children":2043},{"class":459,"line":2042},15,[2044],{"type":43,"tag":457,"props":2045,"children":2046},{"style":487},[2047],{"type":49,"value":2048},"    },\n",{"type":43,"tag":457,"props":2050,"children":2052},{"class":459,"line":2051},16,[2053],{"type":43,"tag":457,"props":2054,"children":2055},{"style":487},[2056],{"type":49,"value":2057},"    \"kibana\": [\n",{"type":43,"tag":457,"props":2059,"children":2061},{"class":459,"line":2060},17,[2062],{"type":43,"tag":457,"props":2063,"children":2064},{"style":487},[2065],{"type":49,"value":1720},{"type":43,"tag":457,"props":2067,"children":2069},{"class":459,"line":2068},18,[2070],{"type":43,"tag":457,"props":2071,"children":2072},{"style":487},[2073],{"type":49,"value":2074},"        \"base\": [],\n",{"type":43,"tag":457,"props":2076,"children":2078},{"class":459,"line":2077},19,[2079],{"type":43,"tag":457,"props":2080,"children":2081},{"style":487},[2082],{"type":49,"value":2083},"        \"feature\": {\n",{"type":43,"tag":457,"props":2085,"children":2087},{"class":459,"line":2086},20,[2088],{"type":43,"tag":457,"props":2089,"children":2090},{"style":487},[2091],{"type":49,"value":2092},"          \"discover\": [\"read\"],\n",{"type":43,"tag":457,"props":2094,"children":2096},{"class":459,"line":2095},21,[2097],{"type":43,"tag":457,"props":2098,"children":2099},{"style":487},[2100],{"type":49,"value":2101},"          \"dashboard\": [\"read\"]\n",{"type":43,"tag":457,"props":2103,"children":2105},{"class":459,"line":2104},22,[2106],{"type":43,"tag":457,"props":2107,"children":2108},{"style":487},[2109],{"type":49,"value":2110},"        },\n",{"type":43,"tag":457,"props":2112,"children":2114},{"class":459,"line":2113},23,[2115],{"type":43,"tag":457,"props":2116,"children":2117},{"style":487},[2118],{"type":49,"value":2119},"        \"spaces\": [\"*\"]\n",{"type":43,"tag":457,"props":2121,"children":2123},{"class":459,"line":2122},24,[2124],{"type":43,"tag":457,"props":2125,"children":2126},{"style":487},[2127],{"type":49,"value":1762},{"type":43,"tag":457,"props":2129,"children":2131},{"class":459,"line":2130},25,[2132],{"type":43,"tag":457,"props":2133,"children":2134},{"style":487},[2135],{"type":49,"value":1771},{"type":43,"tag":457,"props":2137,"children":2139},{"class":459,"line":2138},26,[2140,2144],{"type":43,"tag":457,"props":2141,"children":2142},{"style":487},[2143],{"type":49,"value":1036},{"type":43,"tag":457,"props":2145,"children":2146},{"style":470},[2147],{"type":49,"value":1041},{"type":43,"tag":305,"props":2149,"children":2151},{"id":2150},"get-list-and-delete-roles",[2152],{"type":49,"value":2153},"Get, list, and delete roles",{"type":43,"tag":446,"props":2155,"children":2157},{"className":448,"code":2156,"language":450,"meta":451,"style":451},"curl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002F${ROLE_NAME}\" \u003Cauth_flags>\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\" \u003Cauth_flags>\ncurl -X DELETE \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002F${ROLE_NAME}\" \u003Cauth_flags>\n",[2158],{"type":43,"tag":218,"props":2159,"children":2160},{"__ignoreMap":451},[2161,2212,2255],{"type":43,"tag":457,"props":2162,"children":2163},{"class":459,"line":460},[2164,2168,2172,2176,2180,2184,2188,2192,2196,2200,2204,2208],{"type":43,"tag":457,"props":2165,"children":2166},{"style":464},[2167],{"type":49,"value":467},{"type":43,"tag":457,"props":2169,"children":2170},{"style":470},[2171],{"type":49,"value":473},{"type":43,"tag":457,"props":2173,"children":2174},{"style":476},[2175],{"type":49,"value":479},{"type":43,"tag":457,"props":2177,"children":2178},{"style":470},[2179],{"type":49,"value":484},{"type":43,"tag":457,"props":2181,"children":2182},{"style":487},[2183],{"type":49,"value":1594},{"type":43,"tag":457,"props":2185,"children":2186},{"style":470},[2187],{"type":49,"value":823},{"type":43,"tag":457,"props":2189,"children":2190},{"style":476},[2191],{"type":49,"value":957},{"type":43,"tag":457,"props":2193,"children":2194},{"style":470},[2195],{"type":49,"value":833},{"type":43,"tag":457,"props":2197,"children":2198},{"style":470},[2199],{"type":49,"value":500},{"type":43,"tag":457,"props":2201,"children":2202},{"style":487},[2203],{"type":49,"value":505},{"type":43,"tag":457,"props":2205,"children":2206},{"style":476},[2207],{"type":49,"value":510},{"type":43,"tag":457,"props":2209,"children":2210},{"style":470},[2211],{"type":49,"value":515},{"type":43,"tag":457,"props":2213,"children":2214},{"class":459,"line":841},[2215,2219,2223,2227,2231,2235,2239,2243,2247,2251],{"type":43,"tag":457,"props":2216,"children":2217},{"style":464},[2218],{"type":49,"value":467},{"type":43,"tag":457,"props":2220,"children":2221},{"style":470},[2222],{"type":49,"value":473},{"type":43,"tag":457,"props":2224,"children":2225},{"style":476},[2226],{"type":49,"value":479},{"type":43,"tag":457,"props":2228,"children":2229},{"style":470},[2230],{"type":49,"value":484},{"type":43,"tag":457,"props":2232,"children":2233},{"style":487},[2234],{"type":49,"value":490},{"type":43,"tag":457,"props":2236,"children":2237},{"style":470},[2238],{"type":49,"value":495},{"type":43,"tag":457,"props":2240,"children":2241},{"style":470},[2242],{"type":49,"value":500},{"type":43,"tag":457,"props":2244,"children":2245},{"style":487},[2246],{"type":49,"value":505},{"type":43,"tag":457,"props":2248,"children":2249},{"style":476},[2250],{"type":49,"value":510},{"type":43,"tag":457,"props":2252,"children":2253},{"style":470},[2254],{"type":49,"value":515},{"type":43,"tag":457,"props":2256,"children":2257},{"class":459,"line":867},[2258,2262,2266,2270,2274,2278,2282,2286,2290,2294,2298,2302,2306,2310],{"type":43,"tag":457,"props":2259,"children":2260},{"style":464},[2261],{"type":49,"value":467},{"type":43,"tag":457,"props":2263,"children":2264},{"style":487},[2265],{"type":49,"value":796},{"type":43,"tag":457,"props":2267,"children":2268},{"style":487},[2269],{"type":49,"value":1419},{"type":43,"tag":457,"props":2271,"children":2272},{"style":470},[2273],{"type":49,"value":473},{"type":43,"tag":457,"props":2275,"children":2276},{"style":476},[2277],{"type":49,"value":479},{"type":43,"tag":457,"props":2279,"children":2280},{"style":470},[2281],{"type":49,"value":484},{"type":43,"tag":457,"props":2283,"children":2284},{"style":487},[2285],{"type":49,"value":1594},{"type":43,"tag":457,"props":2287,"children":2288},{"style":470},[2289],{"type":49,"value":823},{"type":43,"tag":457,"props":2291,"children":2292},{"style":476},[2293],{"type":49,"value":957},{"type":43,"tag":457,"props":2295,"children":2296},{"style":470},[2297],{"type":49,"value":833},{"type":43,"tag":457,"props":2299,"children":2300},{"style":470},[2301],{"type":49,"value":500},{"type":43,"tag":457,"props":2303,"children":2304},{"style":487},[2305],{"type":49,"value":505},{"type":43,"tag":457,"props":2307,"children":2308},{"style":476},[2309],{"type":49,"value":510},{"type":43,"tag":457,"props":2311,"children":2312},{"style":470},[2313],{"type":49,"value":515},{"type":43,"tag":106,"props":2315,"children":2317},{"id":2316},"document-level-and-field-level-security",[2318],{"type":49,"value":2319},"Document-Level and Field-Level Security",{"type":43,"tag":52,"props":2321,"children":2322},{},[2323],{"type":49,"value":2324},"Roles can restrict access at the document and field level within an index, going beyond index-level privileges.",{"type":43,"tag":305,"props":2326,"children":2328},{"id":2327},"field-level-security-fls",[2329],{"type":49,"value":2330},"Field-level security (FLS)",{"type":43,"tag":52,"props":2332,"children":2333},{},[2334,2336,2342,2344,2350],{"type":49,"value":2335},"Restrict which fields a role can see. Use ",{"type":43,"tag":218,"props":2337,"children":2339},{"className":2338},[],[2340],{"type":49,"value":2341},"grant",{"type":49,"value":2343}," to whitelist or ",{"type":43,"tag":218,"props":2345,"children":2347},{"className":2346},[],[2348],{"type":49,"value":2349},"except",{"type":49,"value":2351}," to blacklist fields:",{"type":43,"tag":446,"props":2353,"children":2355},{"className":448,"code":2354,"language":450,"meta":451,"style":451},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002Fpii-redacted-reader\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"PII Redacted Reader\",\n    \"indices\": [\n      {\n        \"names\": [\"customers-*\"],\n        \"privileges\": [\"read\"],\n        \"field_security\": {\n          \"grant\": [\"*\"],\n          \"except\": [\"ssn\", \"credit_card\", \"date_of_birth\"]\n        }\n      }\n    ]\n  }'\n",[2356],{"type":43,"tag":218,"props":2357,"children":2358},{"__ignoreMap":451},[2359,2399,2422,2445,2460,2468,2475,2482,2490,2498,2506,2514,2522,2529,2536,2543],{"type":43,"tag":457,"props":2360,"children":2361},{"class":459,"line":460},[2362,2366,2370,2374,2378,2382,2386,2391,2395],{"type":43,"tag":457,"props":2363,"children":2364},{"style":464},[2365],{"type":49,"value":467},{"type":43,"tag":457,"props":2367,"children":2368},{"style":487},[2369],{"type":49,"value":796},{"type":43,"tag":457,"props":2371,"children":2372},{"style":487},[2373],{"type":49,"value":1231},{"type":43,"tag":457,"props":2375,"children":2376},{"style":470},[2377],{"type":49,"value":473},{"type":43,"tag":457,"props":2379,"children":2380},{"style":476},[2381],{"type":49,"value":479},{"type":43,"tag":457,"props":2383,"children":2384},{"style":470},[2385],{"type":49,"value":484},{"type":43,"tag":457,"props":2387,"children":2388},{"style":487},[2389],{"type":49,"value":2390},"\u002F_security\u002Frole\u002Fpii-redacted-reader",{"type":43,"tag":457,"props":2392,"children":2393},{"style":470},[2394],{"type":49,"value":495},{"type":43,"tag":457,"props":2396,"children":2397},{"style":476},[2398],{"type":49,"value":838},{"type":43,"tag":457,"props":2400,"children":2401},{"class":459,"line":841},[2402,2406,2410,2414,2418],{"type":43,"tag":457,"props":2403,"children":2404},{"style":470},[2405],{"type":49,"value":847},{"type":43,"tag":457,"props":2407,"children":2408},{"style":487},[2409],{"type":49,"value":505},{"type":43,"tag":457,"props":2411,"children":2412},{"style":476},[2413],{"type":49,"value":510},{"type":43,"tag":457,"props":2415,"children":2416},{"style":470},[2417],{"type":49,"value":860},{"type":43,"tag":457,"props":2419,"children":2420},{"style":476},[2421],{"type":49,"value":838},{"type":43,"tag":457,"props":2423,"children":2424},{"class":459,"line":867},[2425,2429,2433,2437,2441],{"type":43,"tag":457,"props":2426,"children":2427},{"style":487},[2428],{"type":49,"value":873},{"type":43,"tag":457,"props":2430,"children":2431},{"style":470},[2432],{"type":49,"value":878},{"type":43,"tag":457,"props":2434,"children":2435},{"style":487},[2436],{"type":49,"value":883},{"type":43,"tag":457,"props":2438,"children":2439},{"style":470},[2440],{"type":49,"value":495},{"type":43,"tag":457,"props":2442,"children":2443},{"style":476},[2444],{"type":49,"value":838},{"type":43,"tag":457,"props":2446,"children":2447},{"class":459,"line":894},[2448,2452,2456],{"type":43,"tag":457,"props":2449,"children":2450},{"style":487},[2451],{"type":49,"value":900},{"type":43,"tag":457,"props":2453,"children":2454},{"style":470},[2455],{"type":49,"value":905},{"type":43,"tag":457,"props":2457,"children":2458},{"style":487},[2459],{"type":49,"value":910},{"type":43,"tag":457,"props":2461,"children":2462},{"class":459,"line":913},[2463],{"type":43,"tag":457,"props":2464,"children":2465},{"style":487},[2466],{"type":49,"value":2467},"    \"description\": \"PII Redacted Reader\",\n",{"type":43,"tag":457,"props":2469,"children":2470},{"class":459,"line":942},[2471],{"type":43,"tag":457,"props":2472,"children":2473},{"style":487},[2474],{"type":49,"value":1712},{"type":43,"tag":457,"props":2476,"children":2477},{"class":459,"line":969},[2478],{"type":43,"tag":457,"props":2479,"children":2480},{"style":487},[2481],{"type":49,"value":1720},{"type":43,"tag":457,"props":2483,"children":2484},{"class":459,"line":995},[2485],{"type":43,"tag":457,"props":2486,"children":2487},{"style":487},[2488],{"type":49,"value":2489},"        \"names\": [\"customers-*\"],\n",{"type":43,"tag":457,"props":2491,"children":2492},{"class":459,"line":1021},[2493],{"type":43,"tag":457,"props":2494,"children":2495},{"style":487},[2496],{"type":49,"value":2497},"        \"privileges\": [\"read\"],\n",{"type":43,"tag":457,"props":2499,"children":2500},{"class":459,"line":1030},[2501],{"type":43,"tag":457,"props":2502,"children":2503},{"style":487},[2504],{"type":49,"value":2505},"        \"field_security\": {\n",{"type":43,"tag":457,"props":2507,"children":2508},{"class":459,"line":1756},[2509],{"type":43,"tag":457,"props":2510,"children":2511},{"style":487},[2512],{"type":49,"value":2513},"          \"grant\": [\"*\"],\n",{"type":43,"tag":457,"props":2515,"children":2516},{"class":459,"line":1765},[2517],{"type":43,"tag":457,"props":2518,"children":2519},{"style":487},[2520],{"type":49,"value":2521},"          \"except\": [\"ssn\", \"credit_card\", \"date_of_birth\"]\n",{"type":43,"tag":457,"props":2523,"children":2524},{"class":459,"line":1774},[2525],{"type":43,"tag":457,"props":2526,"children":2527},{"style":487},[2528],{"type":49,"value":2030},{"type":43,"tag":457,"props":2530,"children":2531},{"class":459,"line":2033},[2532],{"type":43,"tag":457,"props":2533,"children":2534},{"style":487},[2535],{"type":49,"value":1762},{"type":43,"tag":457,"props":2537,"children":2538},{"class":459,"line":2042},[2539],{"type":43,"tag":457,"props":2540,"children":2541},{"style":487},[2542],{"type":49,"value":1771},{"type":43,"tag":457,"props":2544,"children":2545},{"class":459,"line":2051},[2546,2550],{"type":43,"tag":457,"props":2547,"children":2548},{"style":487},[2549],{"type":49,"value":1036},{"type":43,"tag":457,"props":2551,"children":2552},{"style":470},[2553],{"type":49,"value":1041},{"type":43,"tag":52,"props":2555,"children":2556},{},[2557],{"type":49,"value":2558},"Users with this role see all fields except the PII fields. FLS is enforced on search, get, and aggregation results.",{"type":43,"tag":305,"props":2560,"children":2562},{"id":2561},"document-level-security-dls",[2563],{"type":49,"value":2564},"Document-level security (DLS)",{"type":43,"tag":52,"props":2566,"children":2567},{},[2568],{"type":49,"value":2569},"Restrict which documents a role can see by attaching a query filter:",{"type":43,"tag":446,"props":2571,"children":2573},{"className":448,"code":2572,"language":450,"meta":451,"style":451},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002Femea-logs-reader\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"EMEA Logs Reader\",\n    \"indices\": [\n      {\n        \"names\": [\"logs-*\"],\n        \"privileges\": [\"read\"],\n        \"query\": \"{\\\"term\\\": {\\\"region\\\": \\\"emea\\\"}}\"\n      }\n    ]\n  }'\n",[2574],{"type":43,"tag":218,"props":2575,"children":2576},{"__ignoreMap":451},[2577,2617,2640,2663,2678,2686,2693,2700,2708,2715,2723,2730,2737],{"type":43,"tag":457,"props":2578,"children":2579},{"class":459,"line":460},[2580,2584,2588,2592,2596,2600,2604,2609,2613],{"type":43,"tag":457,"props":2581,"children":2582},{"style":464},[2583],{"type":49,"value":467},{"type":43,"tag":457,"props":2585,"children":2586},{"style":487},[2587],{"type":49,"value":796},{"type":43,"tag":457,"props":2589,"children":2590},{"style":487},[2591],{"type":49,"value":1231},{"type":43,"tag":457,"props":2593,"children":2594},{"style":470},[2595],{"type":49,"value":473},{"type":43,"tag":457,"props":2597,"children":2598},{"style":476},[2599],{"type":49,"value":479},{"type":43,"tag":457,"props":2601,"children":2602},{"style":470},[2603],{"type":49,"value":484},{"type":43,"tag":457,"props":2605,"children":2606},{"style":487},[2607],{"type":49,"value":2608},"\u002F_security\u002Frole\u002Femea-logs-reader",{"type":43,"tag":457,"props":2610,"children":2611},{"style":470},[2612],{"type":49,"value":495},{"type":43,"tag":457,"props":2614,"children":2615},{"style":476},[2616],{"type":49,"value":838},{"type":43,"tag":457,"props":2618,"children":2619},{"class":459,"line":841},[2620,2624,2628,2632,2636],{"type":43,"tag":457,"props":2621,"children":2622},{"style":470},[2623],{"type":49,"value":847},{"type":43,"tag":457,"props":2625,"children":2626},{"style":487},[2627],{"type":49,"value":505},{"type":43,"tag":457,"props":2629,"children":2630},{"style":476},[2631],{"type":49,"value":510},{"type":43,"tag":457,"props":2633,"children":2634},{"style":470},[2635],{"type":49,"value":860},{"type":43,"tag":457,"props":2637,"children":2638},{"style":476},[2639],{"type":49,"value":838},{"type":43,"tag":457,"props":2641,"children":2642},{"class":459,"line":867},[2643,2647,2651,2655,2659],{"type":43,"tag":457,"props":2644,"children":2645},{"style":487},[2646],{"type":49,"value":873},{"type":43,"tag":457,"props":2648,"children":2649},{"style":470},[2650],{"type":49,"value":878},{"type":43,"tag":457,"props":2652,"children":2653},{"style":487},[2654],{"type":49,"value":883},{"type":43,"tag":457,"props":2656,"children":2657},{"style":470},[2658],{"type":49,"value":495},{"type":43,"tag":457,"props":2660,"children":2661},{"style":476},[2662],{"type":49,"value":838},{"type":43,"tag":457,"props":2664,"children":2665},{"class":459,"line":894},[2666,2670,2674],{"type":43,"tag":457,"props":2667,"children":2668},{"style":487},[2669],{"type":49,"value":900},{"type":43,"tag":457,"props":2671,"children":2672},{"style":470},[2673],{"type":49,"value":905},{"type":43,"tag":457,"props":2675,"children":2676},{"style":487},[2677],{"type":49,"value":910},{"type":43,"tag":457,"props":2679,"children":2680},{"class":459,"line":913},[2681],{"type":43,"tag":457,"props":2682,"children":2683},{"style":487},[2684],{"type":49,"value":2685},"    \"description\": \"EMEA Logs Reader\",\n",{"type":43,"tag":457,"props":2687,"children":2688},{"class":459,"line":942},[2689],{"type":43,"tag":457,"props":2690,"children":2691},{"style":487},[2692],{"type":49,"value":1712},{"type":43,"tag":457,"props":2694,"children":2695},{"class":459,"line":969},[2696],{"type":43,"tag":457,"props":2697,"children":2698},{"style":487},[2699],{"type":49,"value":1720},{"type":43,"tag":457,"props":2701,"children":2702},{"class":459,"line":995},[2703],{"type":43,"tag":457,"props":2704,"children":2705},{"style":487},[2706],{"type":49,"value":2707},"        \"names\": [\"logs-*\"],\n",{"type":43,"tag":457,"props":2709,"children":2710},{"class":459,"line":1021},[2711],{"type":43,"tag":457,"props":2712,"children":2713},{"style":487},[2714],{"type":49,"value":2497},{"type":43,"tag":457,"props":2716,"children":2717},{"class":459,"line":1030},[2718],{"type":43,"tag":457,"props":2719,"children":2720},{"style":487},[2721],{"type":49,"value":2722},"        \"query\": \"{\\\"term\\\": {\\\"region\\\": \\\"emea\\\"}}\"\n",{"type":43,"tag":457,"props":2724,"children":2725},{"class":459,"line":1756},[2726],{"type":43,"tag":457,"props":2727,"children":2728},{"style":487},[2729],{"type":49,"value":1762},{"type":43,"tag":457,"props":2731,"children":2732},{"class":459,"line":1765},[2733],{"type":43,"tag":457,"props":2734,"children":2735},{"style":487},[2736],{"type":49,"value":1771},{"type":43,"tag":457,"props":2738,"children":2739},{"class":459,"line":1774},[2740,2744],{"type":43,"tag":457,"props":2741,"children":2742},{"style":487},[2743],{"type":49,"value":1036},{"type":43,"tag":457,"props":2745,"children":2746},{"style":470},[2747],{"type":49,"value":1041},{"type":43,"tag":52,"props":2749,"children":2750},{},[2751,2753,2759,2761,2767,2769,2775],{"type":49,"value":2752},"The ",{"type":43,"tag":218,"props":2754,"children":2756},{"className":2755},[],[2757],{"type":49,"value":2758},"query",{"type":49,"value":2760}," field is a JSON string containing a Query DSL filter. Users with this role only see documents where ",{"type":43,"tag":218,"props":2762,"children":2764},{"className":2763},[],[2765],{"type":49,"value":2766},"region",{"type":49,"value":2768},"\nequals ",{"type":43,"tag":218,"props":2770,"children":2772},{"className":2771},[],[2773],{"type":49,"value":2774},"emea",{"type":49,"value":82},{"type":43,"tag":305,"props":2777,"children":2779},{"id":2778},"templated-dls-queries-abac",[2780],{"type":49,"value":2781},"Templated DLS queries (ABAC)",{"type":43,"tag":52,"props":2783,"children":2784},{},[2785,2787,2793,2795,2801],{"type":49,"value":2786},"DLS queries support Mustache templates that inject user metadata at query time, enabling attribute-based access control\n(ABAC) on top of RBAC. Store user-specific attributes in the user's ",{"type":43,"tag":218,"props":2788,"children":2790},{"className":2789},[],[2791],{"type":49,"value":2792},"metadata",{"type":49,"value":2794}," field, then reference them in the role\nquery template with ",{"type":43,"tag":218,"props":2796,"children":2798},{"className":2797},[],[2799],{"type":49,"value":2800},"{{_user.metadata.\u003Ckey>}}",{"type":49,"value":82},{"type":43,"tag":446,"props":2803,"children":2805},{"className":448,"code":2804,"language":450,"meta":451,"style":451},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole\u002Fdepartment-reader\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"description\": \"Department Reader\",\n    \"indices\": [\n      {\n        \"names\": [\"records-*\"],\n        \"privileges\": [\"read\"],\n        \"query\": \"{\\\"template\\\": {\\\"source\\\": \\\"{\\\\\\\"term\\\\\\\": {\\\\\\\"department\\\\\\\": \\\\\\\"{{_user.metadata.department}}\\\\\\\"}}\\\"}}\"\n      }\n    ]\n  }'\n",[2806],{"type":43,"tag":218,"props":2807,"children":2808},{"__ignoreMap":451},[2809,2849,2872,2895,2910,2918,2925,2932,2940,2947,2955,2962,2969],{"type":43,"tag":457,"props":2810,"children":2811},{"class":459,"line":460},[2812,2816,2820,2824,2828,2832,2836,2841,2845],{"type":43,"tag":457,"props":2813,"children":2814},{"style":464},[2815],{"type":49,"value":467},{"type":43,"tag":457,"props":2817,"children":2818},{"style":487},[2819],{"type":49,"value":796},{"type":43,"tag":457,"props":2821,"children":2822},{"style":487},[2823],{"type":49,"value":1231},{"type":43,"tag":457,"props":2825,"children":2826},{"style":470},[2827],{"type":49,"value":473},{"type":43,"tag":457,"props":2829,"children":2830},{"style":476},[2831],{"type":49,"value":479},{"type":43,"tag":457,"props":2833,"children":2834},{"style":470},[2835],{"type":49,"value":484},{"type":43,"tag":457,"props":2837,"children":2838},{"style":487},[2839],{"type":49,"value":2840},"\u002F_security\u002Frole\u002Fdepartment-reader",{"type":43,"tag":457,"props":2842,"children":2843},{"style":470},[2844],{"type":49,"value":495},{"type":43,"tag":457,"props":2846,"children":2847},{"style":476},[2848],{"type":49,"value":838},{"type":43,"tag":457,"props":2850,"children":2851},{"class":459,"line":841},[2852,2856,2860,2864,2868],{"type":43,"tag":457,"props":2853,"children":2854},{"style":470},[2855],{"type":49,"value":847},{"type":43,"tag":457,"props":2857,"children":2858},{"style":487},[2859],{"type":49,"value":505},{"type":43,"tag":457,"props":2861,"children":2862},{"style":476},[2863],{"type":49,"value":510},{"type":43,"tag":457,"props":2865,"children":2866},{"style":470},[2867],{"type":49,"value":860},{"type":43,"tag":457,"props":2869,"children":2870},{"style":476},[2871],{"type":49,"value":838},{"type":43,"tag":457,"props":2873,"children":2874},{"class":459,"line":867},[2875,2879,2883,2887,2891],{"type":43,"tag":457,"props":2876,"children":2877},{"style":487},[2878],{"type":49,"value":873},{"type":43,"tag":457,"props":2880,"children":2881},{"style":470},[2882],{"type":49,"value":878},{"type":43,"tag":457,"props":2884,"children":2885},{"style":487},[2886],{"type":49,"value":883},{"type":43,"tag":457,"props":2888,"children":2889},{"style":470},[2890],{"type":49,"value":495},{"type":43,"tag":457,"props":2892,"children":2893},{"style":476},[2894],{"type":49,"value":838},{"type":43,"tag":457,"props":2896,"children":2897},{"class":459,"line":894},[2898,2902,2906],{"type":43,"tag":457,"props":2899,"children":2900},{"style":487},[2901],{"type":49,"value":900},{"type":43,"tag":457,"props":2903,"children":2904},{"style":470},[2905],{"type":49,"value":905},{"type":43,"tag":457,"props":2907,"children":2908},{"style":487},[2909],{"type":49,"value":910},{"type":43,"tag":457,"props":2911,"children":2912},{"class":459,"line":913},[2913],{"type":43,"tag":457,"props":2914,"children":2915},{"style":487},[2916],{"type":49,"value":2917},"    \"description\": \"Department Reader\",\n",{"type":43,"tag":457,"props":2919,"children":2920},{"class":459,"line":942},[2921],{"type":43,"tag":457,"props":2922,"children":2923},{"style":487},[2924],{"type":49,"value":1712},{"type":43,"tag":457,"props":2926,"children":2927},{"class":459,"line":969},[2928],{"type":43,"tag":457,"props":2929,"children":2930},{"style":487},[2931],{"type":49,"value":1720},{"type":43,"tag":457,"props":2933,"children":2934},{"class":459,"line":995},[2935],{"type":43,"tag":457,"props":2936,"children":2937},{"style":487},[2938],{"type":49,"value":2939},"        \"names\": [\"records-*\"],\n",{"type":43,"tag":457,"props":2941,"children":2942},{"class":459,"line":1021},[2943],{"type":43,"tag":457,"props":2944,"children":2945},{"style":487},[2946],{"type":49,"value":2497},{"type":43,"tag":457,"props":2948,"children":2949},{"class":459,"line":1030},[2950],{"type":43,"tag":457,"props":2951,"children":2952},{"style":487},[2953],{"type":49,"value":2954},"        \"query\": \"{\\\"template\\\": {\\\"source\\\": \\\"{\\\\\\\"term\\\\\\\": {\\\\\\\"department\\\\\\\": \\\\\\\"{{_user.metadata.department}}\\\\\\\"}}\\\"}}\"\n",{"type":43,"tag":457,"props":2956,"children":2957},{"class":459,"line":1756},[2958],{"type":43,"tag":457,"props":2959,"children":2960},{"style":487},[2961],{"type":49,"value":1762},{"type":43,"tag":457,"props":2963,"children":2964},{"class":459,"line":1765},[2965],{"type":43,"tag":457,"props":2966,"children":2967},{"style":487},[2968],{"type":49,"value":1771},{"type":43,"tag":457,"props":2970,"children":2971},{"class":459,"line":1774},[2972,2976],{"type":43,"tag":457,"props":2973,"children":2974},{"style":487},[2975],{"type":49,"value":1036},{"type":43,"tag":457,"props":2977,"children":2978},{"style":470},[2979],{"type":49,"value":1041},{"type":43,"tag":52,"props":2981,"children":2982},{},[2983,2985,2991,2993,2999,3001,3007],{"type":49,"value":2984},"A user with ",{"type":43,"tag":218,"props":2986,"children":2988},{"className":2987},[],[2989],{"type":49,"value":2990},"\"metadata\": {\"department\": \"engineering\"}",{"type":49,"value":2992}," only sees documents where ",{"type":43,"tag":218,"props":2994,"children":2996},{"className":2995},[],[2997],{"type":49,"value":2998},"department",{"type":49,"value":3000}," equals ",{"type":43,"tag":218,"props":3002,"children":3004},{"className":3003},[],[3005],{"type":49,"value":3006},"engineering",{"type":49,"value":3008},". The\nsame role works for all departments — no per-department role needed.",{"type":43,"tag":52,"props":3010,"children":3011},{},[3012,3014,3020,3021,3027,3029,3033,3035,3040],{"type":49,"value":3013},"For multi-valued attributes (e.g. a list of required programs), use ",{"type":43,"tag":218,"props":3015,"children":3017},{"className":3016},[],[3018],{"type":49,"value":3019},"terms_set",{"type":49,"value":745},{"type":43,"tag":218,"props":3022,"children":3024},{"className":3023},[],[3025],{"type":49,"value":3026},"minimum_should_match_field",{"type":49,"value":3028}," to\nensure the user holds all required attributes listed on the document. This enables complex ABAC policies — combining\nsecurity levels, program lists, and certification dates — using a single role. See\n",{"type":43,"tag":76,"props":3030,"children":3031},{"href":78},[3032],{"type":49,"value":78},{"type":49,"value":3034}," for full ",{"type":43,"tag":218,"props":3036,"children":3038},{"className":3037},[],[3039],{"type":49,"value":3019},{"type":49,"value":3041}," ABAC examples including combined\nmulti-condition policies and user metadata setup.",{"type":43,"tag":305,"props":3043,"children":3045},{"id":3044},"combining-dls-and-fls",[3046],{"type":49,"value":3047},"Combining DLS and FLS",{"type":43,"tag":52,"props":3049,"children":3050},{},[3051,3053,3058,3060,3066,3068,3074],{"type":49,"value":3052},"A single index privilege entry can include both ",{"type":43,"tag":218,"props":3054,"children":3056},{"className":3055},[],[3057],{"type":49,"value":2758},{"type":49,"value":3059}," (DLS) and ",{"type":43,"tag":218,"props":3061,"children":3063},{"className":3062},[],[3064],{"type":49,"value":3065},"field_security",{"type":49,"value":3067}," (FLS). See the\n",{"type":43,"tag":76,"props":3069,"children":3071},{"href":3070},"#restrict-hr-data-by-department-dls--fls",[3072],{"type":49,"value":3073},"HR department example",{"type":49,"value":3075}," for a practical combined use case.",{"type":43,"tag":52,"props":3077,"children":3078},{},[3079],{"type":49,"value":3080},"When users hold multiple roles, DLS queries are combined with OR and FLS grants are unioned. A broad role without\nDLS\u002FFLS can unintentionally widen access. When combining roles, always verify effective permissions and ensure no\nunrestricted role overrides DLS\u002FFLS intent.",{"type":43,"tag":106,"props":3082,"children":3084},{"id":3083},"assign-roles-to-users",[3085],{"type":49,"value":3086},"Assign Roles to Users",{"type":43,"tag":84,"props":3088,"children":3089},{},[3090],{"type":43,"tag":52,"props":3091,"children":3092},{},[3093,3095,3099,3101,3107],{"type":49,"value":3094},"Self-managed and ECH only. On Serverless, use the ",{"type":43,"tag":63,"props":3096,"children":3097},{},[3098],{"type":49,"value":636},{"type":49,"value":3100}," skill — see\n",{"type":43,"tag":76,"props":3102,"children":3104},{"href":3103},"#serverless-user-access",[3105],{"type":49,"value":3106},"Serverless User Access",{"type":49,"value":82},{"type":43,"tag":52,"props":3109,"children":3110},{},[3111,3113,3119],{"type":49,"value":3112},"Update the user with the new ",{"type":43,"tag":218,"props":3114,"children":3116},{"className":3115},[],[3117],{"type":49,"value":3118},"roles",{"type":49,"value":3120}," array:",{"type":43,"tag":446,"props":3122,"children":3124},{"className":448,"code":3123,"language":450,"meta":451,"style":451},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F${USERNAME}\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"roles\": [\"role-a\", \"role-b\"]\n  }'\n",[3125],{"type":43,"tag":218,"props":3126,"children":3127},{"__ignoreMap":451},[3128,3175,3198,3221,3236,3244],{"type":43,"tag":457,"props":3129,"children":3130},{"class":459,"line":460},[3131,3135,3139,3143,3147,3151,3155,3159,3163,3167,3171],{"type":43,"tag":457,"props":3132,"children":3133},{"style":464},[3134],{"type":49,"value":467},{"type":43,"tag":457,"props":3136,"children":3137},{"style":487},[3138],{"type":49,"value":796},{"type":43,"tag":457,"props":3140,"children":3141},{"style":487},[3142],{"type":49,"value":1231},{"type":43,"tag":457,"props":3144,"children":3145},{"style":470},[3146],{"type":49,"value":473},{"type":43,"tag":457,"props":3148,"children":3149},{"style":476},[3150],{"type":49,"value":479},{"type":43,"tag":457,"props":3152,"children":3153},{"style":470},[3154],{"type":49,"value":484},{"type":43,"tag":457,"props":3156,"children":3157},{"style":487},[3158],{"type":49,"value":818},{"type":43,"tag":457,"props":3160,"children":3161},{"style":470},[3162],{"type":49,"value":823},{"type":43,"tag":457,"props":3164,"children":3165},{"style":476},[3166],{"type":49,"value":828},{"type":43,"tag":457,"props":3168,"children":3169},{"style":470},[3170],{"type":49,"value":833},{"type":43,"tag":457,"props":3172,"children":3173},{"style":476},[3174],{"type":49,"value":838},{"type":43,"tag":457,"props":3176,"children":3177},{"class":459,"line":841},[3178,3182,3186,3190,3194],{"type":43,"tag":457,"props":3179,"children":3180},{"style":470},[3181],{"type":49,"value":847},{"type":43,"tag":457,"props":3183,"children":3184},{"style":487},[3185],{"type":49,"value":505},{"type":43,"tag":457,"props":3187,"children":3188},{"style":476},[3189],{"type":49,"value":510},{"type":43,"tag":457,"props":3191,"children":3192},{"style":470},[3193],{"type":49,"value":860},{"type":43,"tag":457,"props":3195,"children":3196},{"style":476},[3197],{"type":49,"value":838},{"type":43,"tag":457,"props":3199,"children":3200},{"class":459,"line":867},[3201,3205,3209,3213,3217],{"type":43,"tag":457,"props":3202,"children":3203},{"style":487},[3204],{"type":49,"value":873},{"type":43,"tag":457,"props":3206,"children":3207},{"style":470},[3208],{"type":49,"value":878},{"type":43,"tag":457,"props":3210,"children":3211},{"style":487},[3212],{"type":49,"value":883},{"type":43,"tag":457,"props":3214,"children":3215},{"style":470},[3216],{"type":49,"value":495},{"type":43,"tag":457,"props":3218,"children":3219},{"style":476},[3220],{"type":49,"value":838},{"type":43,"tag":457,"props":3222,"children":3223},{"class":459,"line":894},[3224,3228,3232],{"type":43,"tag":457,"props":3225,"children":3226},{"style":487},[3227],{"type":49,"value":900},{"type":43,"tag":457,"props":3229,"children":3230},{"style":470},[3231],{"type":49,"value":905},{"type":43,"tag":457,"props":3233,"children":3234},{"style":487},[3235],{"type":49,"value":910},{"type":43,"tag":457,"props":3237,"children":3238},{"class":459,"line":913},[3239],{"type":43,"tag":457,"props":3240,"children":3241},{"style":487},[3242],{"type":49,"value":3243},"    \"roles\": [\"role-a\", \"role-b\"]\n",{"type":43,"tag":457,"props":3245,"children":3246},{"class":459,"line":942},[3247,3251],{"type":43,"tag":457,"props":3248,"children":3249},{"style":487},[3250],{"type":49,"value":1036},{"type":43,"tag":457,"props":3252,"children":3253},{"style":470},[3254],{"type":49,"value":1041},{"type":43,"tag":52,"props":3256,"children":3257},{},[3258,3259,3264,3266,3271],{"type":49,"value":2752},{"type":43,"tag":218,"props":3260,"children":3262},{"className":3261},[],[3263],{"type":49,"value":3118},{"type":49,"value":3265}," array is ",{"type":43,"tag":63,"props":3267,"children":3268},{},[3269],{"type":49,"value":3270},"replaced entirely",{"type":49,"value":3272}," — include all roles the user should have. Fetch the user first to see current\nroles before updating.",{"type":43,"tag":305,"props":3274,"children":3276},{"id":3275},"verify-effective-permissions",[3277],{"type":49,"value":3278},"Verify effective permissions",{"type":43,"tag":52,"props":3280,"children":3281},{},[3282],{"type":49,"value":3283},"After role or user updates, verify effective access with:",{"type":43,"tag":446,"props":3285,"children":3287},{"className":448,"code":3286,"language":450,"meta":451,"style":451},"curl -X POST \"${ELASTICSEARCH_URL}\u002F_security\u002Fuser\u002F_has_privileges\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"cluster\": [\"monitor\"],\n    \"index\": [\n      {\n        \"names\": [\"'\"${INDEX_PATTERN}\"'\"],\n        \"privileges\": [\"read\", \"view_index_metadata\"]\n      }\n    ]\n  }'\n",[3288],{"type":43,"tag":218,"props":3289,"children":3290},{"__ignoreMap":451},[3291,3331,3354,3377,3392,3400,3408,3415,3438,3445,3452,3459],{"type":43,"tag":457,"props":3292,"children":3293},{"class":459,"line":460},[3294,3298,3302,3306,3310,3314,3318,3323,3327],{"type":43,"tag":457,"props":3295,"children":3296},{"style":464},[3297],{"type":49,"value":467},{"type":43,"tag":457,"props":3299,"children":3300},{"style":487},[3301],{"type":49,"value":796},{"type":43,"tag":457,"props":3303,"children":3304},{"style":487},[3305],{"type":49,"value":801},{"type":43,"tag":457,"props":3307,"children":3308},{"style":470},[3309],{"type":49,"value":473},{"type":43,"tag":457,"props":3311,"children":3312},{"style":476},[3313],{"type":49,"value":479},{"type":43,"tag":457,"props":3315,"children":3316},{"style":470},[3317],{"type":49,"value":484},{"type":43,"tag":457,"props":3319,"children":3320},{"style":487},[3321],{"type":49,"value":3322},"\u002F_security\u002Fuser\u002F_has_privileges",{"type":43,"tag":457,"props":3324,"children":3325},{"style":470},[3326],{"type":49,"value":495},{"type":43,"tag":457,"props":3328,"children":3329},{"style":476},[3330],{"type":49,"value":838},{"type":43,"tag":457,"props":3332,"children":3333},{"class":459,"line":841},[3334,3338,3342,3346,3350],{"type":43,"tag":457,"props":3335,"children":3336},{"style":470},[3337],{"type":49,"value":847},{"type":43,"tag":457,"props":3339,"children":3340},{"style":487},[3341],{"type":49,"value":505},{"type":43,"tag":457,"props":3343,"children":3344},{"style":476},[3345],{"type":49,"value":510},{"type":43,"tag":457,"props":3347,"children":3348},{"style":470},[3349],{"type":49,"value":860},{"type":43,"tag":457,"props":3351,"children":3352},{"style":476},[3353],{"type":49,"value":838},{"type":43,"tag":457,"props":3355,"children":3356},{"class":459,"line":867},[3357,3361,3365,3369,3373],{"type":43,"tag":457,"props":3358,"children":3359},{"style":487},[3360],{"type":49,"value":873},{"type":43,"tag":457,"props":3362,"children":3363},{"style":470},[3364],{"type":49,"value":878},{"type":43,"tag":457,"props":3366,"children":3367},{"style":487},[3368],{"type":49,"value":883},{"type":43,"tag":457,"props":3370,"children":3371},{"style":470},[3372],{"type":49,"value":495},{"type":43,"tag":457,"props":3374,"children":3375},{"style":476},[3376],{"type":49,"value":838},{"type":43,"tag":457,"props":3378,"children":3379},{"class":459,"line":894},[3380,3384,3388],{"type":43,"tag":457,"props":3381,"children":3382},{"style":487},[3383],{"type":49,"value":900},{"type":43,"tag":457,"props":3385,"children":3386},{"style":470},[3387],{"type":49,"value":905},{"type":43,"tag":457,"props":3389,"children":3390},{"style":487},[3391],{"type":49,"value":910},{"type":43,"tag":457,"props":3393,"children":3394},{"class":459,"line":913},[3395],{"type":43,"tag":457,"props":3396,"children":3397},{"style":487},[3398],{"type":49,"value":3399},"    \"cluster\": [\"monitor\"],\n",{"type":43,"tag":457,"props":3401,"children":3402},{"class":459,"line":942},[3403],{"type":43,"tag":457,"props":3404,"children":3405},{"style":487},[3406],{"type":49,"value":3407},"    \"index\": [\n",{"type":43,"tag":457,"props":3409,"children":3410},{"class":459,"line":969},[3411],{"type":43,"tag":457,"props":3412,"children":3413},{"style":487},[3414],{"type":49,"value":1720},{"type":43,"tag":457,"props":3416,"children":3417},{"class":459,"line":995},[3418,3422,3426,3430,3434],{"type":43,"tag":457,"props":3419,"children":3420},{"style":487},[3421],{"type":49,"value":1728},{"type":43,"tag":457,"props":3423,"children":3424},{"style":470},[3425],{"type":49,"value":924},{"type":43,"tag":457,"props":3427,"children":3428},{"style":476},[3429],{"type":49,"value":1737},{"type":43,"tag":457,"props":3431,"children":3432},{"style":470},[3433],{"type":49,"value":934},{"type":43,"tag":457,"props":3435,"children":3436},{"style":487},[3437],{"type":49,"value":966},{"type":43,"tag":457,"props":3439,"children":3440},{"class":459,"line":1021},[3441],{"type":43,"tag":457,"props":3442,"children":3443},{"style":487},[3444],{"type":49,"value":1753},{"type":43,"tag":457,"props":3446,"children":3447},{"class":459,"line":1030},[3448],{"type":43,"tag":457,"props":3449,"children":3450},{"style":487},[3451],{"type":49,"value":1762},{"type":43,"tag":457,"props":3453,"children":3454},{"class":459,"line":1756},[3455],{"type":43,"tag":457,"props":3456,"children":3457},{"style":487},[3458],{"type":49,"value":1771},{"type":43,"tag":457,"props":3460,"children":3461},{"class":459,"line":1765},[3462,3466],{"type":43,"tag":457,"props":3463,"children":3464},{"style":487},[3465],{"type":49,"value":1036},{"type":43,"tag":457,"props":3467,"children":3468},{"style":470},[3469],{"type":49,"value":1041},{"type":43,"tag":106,"props":3471,"children":3473},{"id":3472},"manage-role-mappings",[3474],{"type":49,"value":3475},"Manage Role Mappings",{"type":43,"tag":84,"props":3477,"children":3478},{},[3479],{"type":43,"tag":52,"props":3480,"children":3481},{},[3482,3484,3489,3491,3495,3497,3501],{"type":49,"value":3483},"Role mappings are ",{"type":43,"tag":63,"props":3485,"children":3486},{},[3487],{"type":49,"value":3488},"not available",{"type":49,"value":3490}," on Serverless (both ES API and Kibana UI are disabled). Use the\n",{"type":43,"tag":63,"props":3492,"children":3493},{},[3494],{"type":49,"value":636},{"type":49,"value":3496}," skill instead — see ",{"type":43,"tag":76,"props":3498,"children":3499},{"href":3103},[3500],{"type":49,"value":3106},{"type":49,"value":82},{"type":43,"tag":52,"props":3503,"children":3504},{},[3505,3507,3515],{"type":49,"value":3506},"Role mappings assign external-realm users (LDAP, AD, SAML, PKI) to roles based on attribute rules. Self-managed and ECH\nonly. For supported rule operators and resource fields, see\n",{"type":43,"tag":76,"props":3508,"children":3512},{"href":3509,"rel":3510},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fdeploy-manage\u002Fusers-roles\u002Fcluster-or-deployment-auth\u002Frole-mapping-resources",[3511],"nofollow",[3513],{"type":49,"value":3514},"role mapping resource properties",{"type":49,"value":82},{"type":43,"tag":305,"props":3517,"children":3519},{"id":3518},"static-role-mapping",[3520],{"type":49,"value":3521},"Static role mapping",{"type":43,"tag":446,"props":3523,"children":3525},{"className":448,"code":3524,"language":450,"meta":451,"style":451},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fsaml-default-access\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"roles\": [\"viewer\"],\n    \"enabled\": true,\n    \"rules\": {\n      \"field\": { \"realm.name\": \"saml1\" }\n    }\n  }'\n",[3526],{"type":43,"tag":218,"props":3527,"children":3528},{"__ignoreMap":451},[3529,3569,3592,3615,3630,3638,3646,3654,3662,3670],{"type":43,"tag":457,"props":3530,"children":3531},{"class":459,"line":460},[3532,3536,3540,3544,3548,3552,3556,3561,3565],{"type":43,"tag":457,"props":3533,"children":3534},{"style":464},[3535],{"type":49,"value":467},{"type":43,"tag":457,"props":3537,"children":3538},{"style":487},[3539],{"type":49,"value":796},{"type":43,"tag":457,"props":3541,"children":3542},{"style":487},[3543],{"type":49,"value":1231},{"type":43,"tag":457,"props":3545,"children":3546},{"style":470},[3547],{"type":49,"value":473},{"type":43,"tag":457,"props":3549,"children":3550},{"style":476},[3551],{"type":49,"value":479},{"type":43,"tag":457,"props":3553,"children":3554},{"style":470},[3555],{"type":49,"value":484},{"type":43,"tag":457,"props":3557,"children":3558},{"style":487},[3559],{"type":49,"value":3560},"\u002F_security\u002Frole_mapping\u002Fsaml-default-access",{"type":43,"tag":457,"props":3562,"children":3563},{"style":470},[3564],{"type":49,"value":495},{"type":43,"tag":457,"props":3566,"children":3567},{"style":476},[3568],{"type":49,"value":838},{"type":43,"tag":457,"props":3570,"children":3571},{"class":459,"line":841},[3572,3576,3580,3584,3588],{"type":43,"tag":457,"props":3573,"children":3574},{"style":470},[3575],{"type":49,"value":847},{"type":43,"tag":457,"props":3577,"children":3578},{"style":487},[3579],{"type":49,"value":505},{"type":43,"tag":457,"props":3581,"children":3582},{"style":476},[3583],{"type":49,"value":510},{"type":43,"tag":457,"props":3585,"children":3586},{"style":470},[3587],{"type":49,"value":860},{"type":43,"tag":457,"props":3589,"children":3590},{"style":476},[3591],{"type":49,"value":838},{"type":43,"tag":457,"props":3593,"children":3594},{"class":459,"line":867},[3595,3599,3603,3607,3611],{"type":43,"tag":457,"props":3596,"children":3597},{"style":487},[3598],{"type":49,"value":873},{"type":43,"tag":457,"props":3600,"children":3601},{"style":470},[3602],{"type":49,"value":878},{"type":43,"tag":457,"props":3604,"children":3605},{"style":487},[3606],{"type":49,"value":883},{"type":43,"tag":457,"props":3608,"children":3609},{"style":470},[3610],{"type":49,"value":495},{"type":43,"tag":457,"props":3612,"children":3613},{"style":476},[3614],{"type":49,"value":838},{"type":43,"tag":457,"props":3616,"children":3617},{"class":459,"line":894},[3618,3622,3626],{"type":43,"tag":457,"props":3619,"children":3620},{"style":487},[3621],{"type":49,"value":900},{"type":43,"tag":457,"props":3623,"children":3624},{"style":470},[3625],{"type":49,"value":905},{"type":43,"tag":457,"props":3627,"children":3628},{"style":487},[3629],{"type":49,"value":910},{"type":43,"tag":457,"props":3631,"children":3632},{"class":459,"line":913},[3633],{"type":43,"tag":457,"props":3634,"children":3635},{"style":487},[3636],{"type":49,"value":3637},"    \"roles\": [\"viewer\"],\n",{"type":43,"tag":457,"props":3639,"children":3640},{"class":459,"line":942},[3641],{"type":43,"tag":457,"props":3642,"children":3643},{"style":487},[3644],{"type":49,"value":3645},"    \"enabled\": true,\n",{"type":43,"tag":457,"props":3647,"children":3648},{"class":459,"line":969},[3649],{"type":43,"tag":457,"props":3650,"children":3651},{"style":487},[3652],{"type":49,"value":3653},"    \"rules\": {\n",{"type":43,"tag":457,"props":3655,"children":3656},{"class":459,"line":995},[3657],{"type":43,"tag":457,"props":3658,"children":3659},{"style":487},[3660],{"type":49,"value":3661},"      \"field\": { \"realm.name\": \"saml1\" }\n",{"type":43,"tag":457,"props":3663,"children":3664},{"class":459,"line":1021},[3665],{"type":43,"tag":457,"props":3666,"children":3667},{"style":487},[3668],{"type":49,"value":3669},"    }\n",{"type":43,"tag":457,"props":3671,"children":3672},{"class":459,"line":1030},[3673,3677],{"type":43,"tag":457,"props":3674,"children":3675},{"style":487},[3676],{"type":49,"value":1036},{"type":43,"tag":457,"props":3678,"children":3679},{"style":470},[3680],{"type":49,"value":1041},{"type":43,"tag":305,"props":3682,"children":3684},{"id":3683},"ldap-group-based-mapping",[3685],{"type":49,"value":3686},"LDAP group-based mapping",{"type":43,"tag":446,"props":3688,"children":3690},{"className":448,"code":3689,"language":450,"meta":451,"style":451},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fldap-admins\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"roles\": [\"superuser\"],\n    \"enabled\": true,\n    \"rules\": {\n      \"all\": [\n        { \"field\": { \"realm.name\": \"ldap1\" } },\n        { \"field\": { \"groups\": \"cn=admins,ou=groups,dc=example,dc=com\" } }\n      ]\n    }\n  }'\n",[3691],{"type":43,"tag":218,"props":3692,"children":3693},{"__ignoreMap":451},[3694,3734,3757,3780,3795,3803,3810,3817,3825,3833,3841,3848,3855],{"type":43,"tag":457,"props":3695,"children":3696},{"class":459,"line":460},[3697,3701,3705,3709,3713,3717,3721,3726,3730],{"type":43,"tag":457,"props":3698,"children":3699},{"style":464},[3700],{"type":49,"value":467},{"type":43,"tag":457,"props":3702,"children":3703},{"style":487},[3704],{"type":49,"value":796},{"type":43,"tag":457,"props":3706,"children":3707},{"style":487},[3708],{"type":49,"value":1231},{"type":43,"tag":457,"props":3710,"children":3711},{"style":470},[3712],{"type":49,"value":473},{"type":43,"tag":457,"props":3714,"children":3715},{"style":476},[3716],{"type":49,"value":479},{"type":43,"tag":457,"props":3718,"children":3719},{"style":470},[3720],{"type":49,"value":484},{"type":43,"tag":457,"props":3722,"children":3723},{"style":487},[3724],{"type":49,"value":3725},"\u002F_security\u002Frole_mapping\u002Fldap-admins",{"type":43,"tag":457,"props":3727,"children":3728},{"style":470},[3729],{"type":49,"value":495},{"type":43,"tag":457,"props":3731,"children":3732},{"style":476},[3733],{"type":49,"value":838},{"type":43,"tag":457,"props":3735,"children":3736},{"class":459,"line":841},[3737,3741,3745,3749,3753],{"type":43,"tag":457,"props":3738,"children":3739},{"style":470},[3740],{"type":49,"value":847},{"type":43,"tag":457,"props":3742,"children":3743},{"style":487},[3744],{"type":49,"value":505},{"type":43,"tag":457,"props":3746,"children":3747},{"style":476},[3748],{"type":49,"value":510},{"type":43,"tag":457,"props":3750,"children":3751},{"style":470},[3752],{"type":49,"value":860},{"type":43,"tag":457,"props":3754,"children":3755},{"style":476},[3756],{"type":49,"value":838},{"type":43,"tag":457,"props":3758,"children":3759},{"class":459,"line":867},[3760,3764,3768,3772,3776],{"type":43,"tag":457,"props":3761,"children":3762},{"style":487},[3763],{"type":49,"value":873},{"type":43,"tag":457,"props":3765,"children":3766},{"style":470},[3767],{"type":49,"value":878},{"type":43,"tag":457,"props":3769,"children":3770},{"style":487},[3771],{"type":49,"value":883},{"type":43,"tag":457,"props":3773,"children":3774},{"style":470},[3775],{"type":49,"value":495},{"type":43,"tag":457,"props":3777,"children":3778},{"style":476},[3779],{"type":49,"value":838},{"type":43,"tag":457,"props":3781,"children":3782},{"class":459,"line":894},[3783,3787,3791],{"type":43,"tag":457,"props":3784,"children":3785},{"style":487},[3786],{"type":49,"value":900},{"type":43,"tag":457,"props":3788,"children":3789},{"style":470},[3790],{"type":49,"value":905},{"type":43,"tag":457,"props":3792,"children":3793},{"style":487},[3794],{"type":49,"value":910},{"type":43,"tag":457,"props":3796,"children":3797},{"class":459,"line":913},[3798],{"type":43,"tag":457,"props":3799,"children":3800},{"style":487},[3801],{"type":49,"value":3802},"    \"roles\": [\"superuser\"],\n",{"type":43,"tag":457,"props":3804,"children":3805},{"class":459,"line":942},[3806],{"type":43,"tag":457,"props":3807,"children":3808},{"style":487},[3809],{"type":49,"value":3645},{"type":43,"tag":457,"props":3811,"children":3812},{"class":459,"line":969},[3813],{"type":43,"tag":457,"props":3814,"children":3815},{"style":487},[3816],{"type":49,"value":3653},{"type":43,"tag":457,"props":3818,"children":3819},{"class":459,"line":995},[3820],{"type":43,"tag":457,"props":3821,"children":3822},{"style":487},[3823],{"type":49,"value":3824},"      \"all\": [\n",{"type":43,"tag":457,"props":3826,"children":3827},{"class":459,"line":1021},[3828],{"type":43,"tag":457,"props":3829,"children":3830},{"style":487},[3831],{"type":49,"value":3832},"        { \"field\": { \"realm.name\": \"ldap1\" } },\n",{"type":43,"tag":457,"props":3834,"children":3835},{"class":459,"line":1030},[3836],{"type":43,"tag":457,"props":3837,"children":3838},{"style":487},[3839],{"type":49,"value":3840},"        { \"field\": { \"groups\": \"cn=admins,ou=groups,dc=example,dc=com\" } }\n",{"type":43,"tag":457,"props":3842,"children":3843},{"class":459,"line":1756},[3844],{"type":43,"tag":457,"props":3845,"children":3846},{"style":487},[3847],{"type":49,"value":2039},{"type":43,"tag":457,"props":3849,"children":3850},{"class":459,"line":1765},[3851],{"type":43,"tag":457,"props":3852,"children":3853},{"style":487},[3854],{"type":49,"value":3669},{"type":43,"tag":457,"props":3856,"children":3857},{"class":459,"line":1774},[3858,3862],{"type":43,"tag":457,"props":3859,"children":3860},{"style":487},[3861],{"type":49,"value":1036},{"type":43,"tag":457,"props":3863,"children":3864},{"style":470},[3865],{"type":49,"value":1041},{"type":43,"tag":305,"props":3867,"children":3869},{"id":3868},"dynamic-role-assignment-with-mustache-templates",[3870],{"type":49,"value":3871},"Dynamic role assignment with Mustache templates",{"type":43,"tag":52,"props":3873,"children":3874},{},[3875,3876,3882,3884,3889],{"type":49,"value":1052},{"type":43,"tag":218,"props":3877,"children":3879},{"className":3878},[],[3880],{"type":49,"value":3881},"role_templates",{"type":49,"value":3883}," instead of ",{"type":43,"tag":218,"props":3885,"children":3887},{"className":3886},[],[3888],{"type":49,"value":3118},{"type":49,"value":3890}," to derive role names from user attributes. Scripting must be enabled.",{"type":43,"tag":446,"props":3892,"children":3894},{"className":448,"code":3893,"language":450,"meta":451,"style":451},"curl -X PUT \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fldap-group-roles\" \\\n  \u003Cauth_flags> \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"role_templates\": [\n      {\n        \"template\": { \"source\": \"{{#tojson}}groups{{\u002Ftojson}}\" },\n        \"format\": \"json\"\n      }\n    ],\n    \"enabled\": true,\n    \"rules\": {\n      \"field\": { \"realm.name\": \"ldap1\" }\n    }\n  }'\n",[3895],{"type":43,"tag":218,"props":3896,"children":3897},{"__ignoreMap":451},[3898,3938,3961,3984,3999,4007,4014,4022,4030,4037,4045,4052,4059,4067,4074],{"type":43,"tag":457,"props":3899,"children":3900},{"class":459,"line":460},[3901,3905,3909,3913,3917,3921,3925,3930,3934],{"type":43,"tag":457,"props":3902,"children":3903},{"style":464},[3904],{"type":49,"value":467},{"type":43,"tag":457,"props":3906,"children":3907},{"style":487},[3908],{"type":49,"value":796},{"type":43,"tag":457,"props":3910,"children":3911},{"style":487},[3912],{"type":49,"value":1231},{"type":43,"tag":457,"props":3914,"children":3915},{"style":470},[3916],{"type":49,"value":473},{"type":43,"tag":457,"props":3918,"children":3919},{"style":476},[3920],{"type":49,"value":479},{"type":43,"tag":457,"props":3922,"children":3923},{"style":470},[3924],{"type":49,"value":484},{"type":43,"tag":457,"props":3926,"children":3927},{"style":487},[3928],{"type":49,"value":3929},"\u002F_security\u002Frole_mapping\u002Fldap-group-roles",{"type":43,"tag":457,"props":3931,"children":3932},{"style":470},[3933],{"type":49,"value":495},{"type":43,"tag":457,"props":3935,"children":3936},{"style":476},[3937],{"type":49,"value":838},{"type":43,"tag":457,"props":3939,"children":3940},{"class":459,"line":841},[3941,3945,3949,3953,3957],{"type":43,"tag":457,"props":3942,"children":3943},{"style":470},[3944],{"type":49,"value":847},{"type":43,"tag":457,"props":3946,"children":3947},{"style":487},[3948],{"type":49,"value":505},{"type":43,"tag":457,"props":3950,"children":3951},{"style":476},[3952],{"type":49,"value":510},{"type":43,"tag":457,"props":3954,"children":3955},{"style":470},[3956],{"type":49,"value":860},{"type":43,"tag":457,"props":3958,"children":3959},{"style":476},[3960],{"type":49,"value":838},{"type":43,"tag":457,"props":3962,"children":3963},{"class":459,"line":867},[3964,3968,3972,3976,3980],{"type":43,"tag":457,"props":3965,"children":3966},{"style":487},[3967],{"type":49,"value":873},{"type":43,"tag":457,"props":3969,"children":3970},{"style":470},[3971],{"type":49,"value":878},{"type":43,"tag":457,"props":3973,"children":3974},{"style":487},[3975],{"type":49,"value":883},{"type":43,"tag":457,"props":3977,"children":3978},{"style":470},[3979],{"type":49,"value":495},{"type":43,"tag":457,"props":3981,"children":3982},{"style":476},[3983],{"type":49,"value":838},{"type":43,"tag":457,"props":3985,"children":3986},{"class":459,"line":894},[3987,3991,3995],{"type":43,"tag":457,"props":3988,"children":3989},{"style":487},[3990],{"type":49,"value":900},{"type":43,"tag":457,"props":3992,"children":3993},{"style":470},[3994],{"type":49,"value":905},{"type":43,"tag":457,"props":3996,"children":3997},{"style":487},[3998],{"type":49,"value":910},{"type":43,"tag":457,"props":4000,"children":4001},{"class":459,"line":913},[4002],{"type":43,"tag":457,"props":4003,"children":4004},{"style":487},[4005],{"type":49,"value":4006},"    \"role_templates\": [\n",{"type":43,"tag":457,"props":4008,"children":4009},{"class":459,"line":942},[4010],{"type":43,"tag":457,"props":4011,"children":4012},{"style":487},[4013],{"type":49,"value":1720},{"type":43,"tag":457,"props":4015,"children":4016},{"class":459,"line":969},[4017],{"type":43,"tag":457,"props":4018,"children":4019},{"style":487},[4020],{"type":49,"value":4021},"        \"template\": { \"source\": \"{{#tojson}}groups{{\u002Ftojson}}\" },\n",{"type":43,"tag":457,"props":4023,"children":4024},{"class":459,"line":995},[4025],{"type":43,"tag":457,"props":4026,"children":4027},{"style":487},[4028],{"type":49,"value":4029},"        \"format\": \"json\"\n",{"type":43,"tag":457,"props":4031,"children":4032},{"class":459,"line":1021},[4033],{"type":43,"tag":457,"props":4034,"children":4035},{"style":487},[4036],{"type":49,"value":1762},{"type":43,"tag":457,"props":4038,"children":4039},{"class":459,"line":1030},[4040],{"type":43,"tag":457,"props":4041,"children":4042},{"style":487},[4043],{"type":49,"value":4044},"    ],\n",{"type":43,"tag":457,"props":4046,"children":4047},{"class":459,"line":1756},[4048],{"type":43,"tag":457,"props":4049,"children":4050},{"style":487},[4051],{"type":49,"value":3645},{"type":43,"tag":457,"props":4053,"children":4054},{"class":459,"line":1765},[4055],{"type":43,"tag":457,"props":4056,"children":4057},{"style":487},[4058],{"type":49,"value":3653},{"type":43,"tag":457,"props":4060,"children":4061},{"class":459,"line":1774},[4062],{"type":43,"tag":457,"props":4063,"children":4064},{"style":487},[4065],{"type":49,"value":4066},"      \"field\": { \"realm.name\": \"ldap1\" }\n",{"type":43,"tag":457,"props":4068,"children":4069},{"class":459,"line":2033},[4070],{"type":43,"tag":457,"props":4071,"children":4072},{"style":487},[4073],{"type":49,"value":3669},{"type":43,"tag":457,"props":4075,"children":4076},{"class":459,"line":2042},[4077,4081],{"type":43,"tag":457,"props":4078,"children":4079},{"style":487},[4080],{"type":49,"value":1036},{"type":43,"tag":457,"props":4082,"children":4083},{"style":470},[4084],{"type":49,"value":1041},{"type":43,"tag":52,"props":4086,"children":4087},{},[4088,4090,4094],{"type":49,"value":4089},"See ",{"type":43,"tag":76,"props":4091,"children":4092},{"href":78},[4093],{"type":49,"value":78},{"type":49,"value":4095}," for more Mustache patterns including realm-username\nderived roles and tiered group access.",{"type":43,"tag":305,"props":4097,"children":4099},{"id":4098},"get-list-and-delete-role-mappings",[4100],{"type":49,"value":4101},"Get, list, and delete role mappings",{"type":43,"tag":446,"props":4103,"children":4105},{"className":448,"code":4104,"language":450,"meta":451,"style":451},"curl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fsaml-default-access\" \u003Cauth_flags>\ncurl \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\" \u003Cauth_flags>\ncurl -X DELETE \"${ELASTICSEARCH_URL}\u002F_security\u002Frole_mapping\u002Fsaml-default-access\" \u003Cauth_flags>\n",[4106],{"type":43,"tag":218,"props":4107,"children":4108},{"__ignoreMap":451},[4109,4152,4196],{"type":43,"tag":457,"props":4110,"children":4111},{"class":459,"line":460},[4112,4116,4120,4124,4128,4132,4136,4140,4144,4148],{"type":43,"tag":457,"props":4113,"children":4114},{"style":464},[4115],{"type":49,"value":467},{"type":43,"tag":457,"props":4117,"children":4118},{"style":470},[4119],{"type":49,"value":473},{"type":43,"tag":457,"props":4121,"children":4122},{"style":476},[4123],{"type":49,"value":479},{"type":43,"tag":457,"props":4125,"children":4126},{"style":470},[4127],{"type":49,"value":484},{"type":43,"tag":457,"props":4129,"children":4130},{"style":487},[4131],{"type":49,"value":3560},{"type":43,"tag":457,"props":4133,"children":4134},{"style":470},[4135],{"type":49,"value":495},{"type":43,"tag":457,"props":4137,"children":4138},{"style":470},[4139],{"type":49,"value":500},{"type":43,"tag":457,"props":4141,"children":4142},{"style":487},[4143],{"type":49,"value":505},{"type":43,"tag":457,"props":4145,"children":4146},{"style":476},[4147],{"type":49,"value":510},{"type":43,"tag":457,"props":4149,"children":4150},{"style":470},[4151],{"type":49,"value":515},{"type":43,"tag":457,"props":4153,"children":4154},{"class":459,"line":841},[4155,4159,4163,4167,4171,4176,4180,4184,4188,4192],{"type":43,"tag":457,"props":4156,"children":4157},{"style":464},[4158],{"type":49,"value":467},{"type":43,"tag":457,"props":4160,"children":4161},{"style":470},[4162],{"type":49,"value":473},{"type":43,"tag":457,"props":4164,"children":4165},{"style":476},[4166],{"type":49,"value":479},{"type":43,"tag":457,"props":4168,"children":4169},{"style":470},[4170],{"type":49,"value":484},{"type":43,"tag":457,"props":4172,"children":4173},{"style":487},[4174],{"type":49,"value":4175},"\u002F_security\u002Frole_mapping",{"type":43,"tag":457,"props":4177,"children":4178},{"style":470},[4179],{"type":49,"value":495},{"type":43,"tag":457,"props":4181,"children":4182},{"style":470},[4183],{"type":49,"value":500},{"type":43,"tag":457,"props":4185,"children":4186},{"style":487},[4187],{"type":49,"value":505},{"type":43,"tag":457,"props":4189,"children":4190},{"style":476},[4191],{"type":49,"value":510},{"type":43,"tag":457,"props":4193,"children":4194},{"style":470},[4195],{"type":49,"value":515},{"type":43,"tag":457,"props":4197,"children":4198},{"class":459,"line":867},[4199,4203,4207,4211,4215,4219,4223,4227,4231,4235,4239,4243],{"type":43,"tag":457,"props":4200,"children":4201},{"style":464},[4202],{"type":49,"value":467},{"type":43,"tag":457,"props":4204,"children":4205},{"style":487},[4206],{"type":49,"value":796},{"type":43,"tag":457,"props":4208,"children":4209},{"style":487},[4210],{"type":49,"value":1419},{"type":43,"tag":457,"props":4212,"children":4213},{"style":470},[4214],{"type":49,"value":473},{"type":43,"tag":457,"props":4216,"children":4217},{"style":476},[4218],{"type":49,"value":479},{"type":43,"tag":457,"props":4220,"children":4221},{"style":470},[4222],{"type":49,"value":484},{"type":43,"tag":457,"props":4224,"children":4225},{"style":487},[4226],{"type":49,"value":3560},{"type":43,"tag":457,"props":4228,"children":4229},{"style":470},[4230],{"type":49,"value":495},{"type":43,"tag":457,"props":4232,"children":4233},{"style":470},[4234],{"type":49,"value":500},{"type":43,"tag":457,"props":4236,"children":4237},{"style":487},[4238],{"type":49,"value":505},{"type":43,"tag":457,"props":4240,"children":4241},{"style":476},[4242],{"type":49,"value":510},{"type":43,"tag":457,"props":4244,"children":4245},{"style":470},[4246],{"type":49,"value":515},{"type":43,"tag":106,"props":4248,"children":4250},{"id":4249},"serverless-user-access",[4251],{"type":49,"value":3106},{"type":43,"tag":52,"props":4253,"children":4254},{},[4255],{"type":49,"value":4256},"On Serverless, there are no native users or role mappings. Users receive project access through Cloud-level role\nassignments.",{"type":43,"tag":113,"props":4258,"children":4259},{},[4260,4293,4310],{"type":43,"tag":117,"props":4261,"children":4262},{},[4263,4268,4270,4276,4278,4284,4285,4291],{"type":43,"tag":63,"props":4264,"children":4265},{},[4266],{"type":49,"value":4267},"Predefined roles",{"type":49,"value":4269}," (e.g. ",{"type":43,"tag":218,"props":4271,"children":4273},{"className":4272},[],[4274],{"type":49,"value":4275},"admin",{"type":49,"value":4277},", ",{"type":43,"tag":218,"props":4279,"children":4281},{"className":4280},[],[4282],{"type":49,"value":4283},"developer",{"type":49,"value":4277},{"type":43,"tag":218,"props":4286,"children":4288},{"className":4287},[],[4289],{"type":49,"value":4290},"viewer",{"type":49,"value":4292},") cover common access patterns. If one fits, assign it\ndirectly via the Cloud API — no custom role creation needed.",{"type":43,"tag":117,"props":4294,"children":4295},{},[4296,4301,4303,4308],{"type":43,"tag":63,"props":4297,"children":4298},{},[4299],{"type":49,"value":4300},"Custom roles",{"type":49,"value":4302}," are required when the user needs fine-grained access (specific indices, Kibana features, DLS\u002FFLS).\nCreate the custom role using the Elasticsearch API or Kibana API (same as self-managed — see\n",{"type":43,"tag":76,"props":4304,"children":4306},{"href":4305},"#manage-roles",[4307],{"type":49,"value":1469},{"type":49,"value":4309},"), then assign it to the user alongside a predefined base role via the Cloud API.",{"type":43,"tag":117,"props":4311,"children":4312},{},[4313,4318],{"type":43,"tag":63,"props":4314,"children":4315},{},[4316],{"type":49,"value":4317},"Run-as",{"type":49,"value":4319}," privileges are unavailable in Serverless custom roles.",{"type":43,"tag":52,"props":4321,"children":4322},{},[4323,4324,4328],{"type":49,"value":631},{"type":43,"tag":63,"props":4325,"children":4326},{},[4327],{"type":49,"value":636},{"type":49,"value":4329}," skill for the full workflow (inviting users, assigning roles, managing Cloud API\nkeys, and verifying access). This skill handles only role definition; cloud-access-management handles user assignment.",{"type":43,"tag":106,"props":4331,"children":4333},{"id":4332},"examples",[4334],{"type":49,"value":4335},"Examples",{"type":43,"tag":305,"props":4337,"children":4339},{"id":4338},"create-a-read-only-user-for-logs",[4340],{"type":49,"value":4341},"Create a read-only user for logs",{"type":43,"tag":52,"props":4343,"children":4344},{},[4345,4350,4351,4357,4358,4363],{"type":43,"tag":63,"props":4346,"children":4347},{},[4348],{"type":49,"value":4349},"Request:",{"type":49,"value":654},{"type":43,"tag":218,"props":4352,"children":4354},{"className":4353},[],[4355],{"type":49,"value":4356},"joe",{"type":49,"value":662},{"type":43,"tag":218,"props":4359,"children":4361},{"className":4360},[],[4362],{"type":49,"value":301},{"type":49,"value":4364},".\"",{"type":43,"tag":679,"props":4366,"children":4367},{},[4368,4395],{"type":43,"tag":117,"props":4369,"children":4370},{},[4371,4373,4379,4380,4386,4388,4394],{"type":49,"value":4372},"Create the role via ",{"type":43,"tag":218,"props":4374,"children":4376},{"className":4375},[],[4377],{"type":49,"value":4378},"PUT \u002F_security\u002Frole\u002Flogs-reader",{"type":49,"value":745},{"type":43,"tag":218,"props":4381,"children":4383},{"className":4382},[],[4384],{"type":49,"value":4385},"\"description\": \"Logs Reader\"",{"type":49,"value":4387}," and\n",{"type":43,"tag":218,"props":4389,"children":4391},{"className":4390},[],[4392],{"type":49,"value":4393},"indices: [{ names: [\"logs-*\"], privileges: [\"read\", \"view_index_metadata\"] }]",{"type":49,"value":82},{"type":43,"tag":117,"props":4396,"children":4397},{},[4398,4400,4406,4407,4413],{"type":49,"value":4399},"Create the user via ",{"type":43,"tag":218,"props":4401,"children":4403},{"className":4402},[],[4404],{"type":49,"value":4405},"POST \u002F_security\u002Fuser\u002Fjoe",{"type":49,"value":745},{"type":43,"tag":218,"props":4408,"children":4410},{"className":4409},[],[4411],{"type":49,"value":4412},"\"roles\": [\"logs-reader\"]",{"type":49,"value":4414}," and a strong generated password.",{"type":43,"tag":305,"props":4416,"children":4418},{"id":4417},"create-a-role-with-kibana-dashboard-access",[4419],{"type":49,"value":4420},"Create a role with Kibana dashboard access",{"type":43,"tag":52,"props":4422,"children":4423},{},[4424,4428,4430,4435],{"type":43,"tag":63,"props":4425,"children":4426},{},[4427],{"type":49,"value":4349},{"type":49,"value":4429}," \"Let users read ",{"type":43,"tag":218,"props":4431,"children":4433},{"className":4432},[],[4434],{"type":49,"value":301},{"type":49,"value":677},{"type":43,"tag":52,"props":4437,"children":4438},{},[4439,4441,4447,4449,4455,4457,4463,4465,4470],{"type":49,"value":4440},"Use the Kibana API (",{"type":43,"tag":218,"props":4442,"children":4444},{"className":4443},[],[4445],{"type":49,"value":4446},"PUT \u003CKIBANA_URL>\u002Fapi\u002Fsecurity\u002Frole\u002Flogs-dashboard-viewer",{"type":49,"value":4448},") with ",{"type":43,"tag":218,"props":4450,"children":4452},{"className":4451},[],[4453],{"type":49,"value":4454},"elasticsearch.indices",{"type":49,"value":4456}," for data\naccess and ",{"type":43,"tag":218,"props":4458,"children":4460},{"className":4459},[],[4461],{"type":49,"value":4462},"kibana[].feature",{"type":49,"value":4464}," for dashboard and Discover read access on all spaces. See\n",{"type":43,"tag":76,"props":4466,"children":4468},{"href":4467},"#create-or-update-a-role-kibana-api",[4469],{"type":49,"value":1789},{"type":49,"value":4471}," for the full request structure.",{"type":43,"tag":305,"props":4473,"children":4475},{"id":4474},"add-a-role-to-an-existing-user",[4476],{"type":49,"value":4477},"Add a role to an existing user",{"type":43,"tag":52,"props":4479,"children":4480},{},[4481,4485,4487,4493],{"type":43,"tag":63,"props":4482,"children":4483},{},[4484],{"type":49,"value":4349},{"type":49,"value":4486}," \"Give Alice access to ",{"type":43,"tag":218,"props":4488,"children":4490},{"className":4489},[],[4491],{"type":49,"value":4492},"apm-*",{"type":49,"value":4494}," in addition to her current roles.\"",{"type":43,"tag":679,"props":4496,"children":4497},{},[4498,4516,4536],{"type":43,"tag":117,"props":4499,"children":4500},{},[4501,4507,4509,4515],{"type":43,"tag":218,"props":4502,"children":4504},{"className":4503},[],[4505],{"type":49,"value":4506},"GET \u002F_security\u002Fuser\u002Falice",{"type":49,"value":4508}," — response shows ",{"type":43,"tag":218,"props":4510,"children":4512},{"className":4511},[],[4513],{"type":49,"value":4514},"\"roles\": [\"viewer\"]",{"type":49,"value":82},{"type":43,"tag":117,"props":4517,"children":4518},{},[4519,4521,4527,4529,4535],{"type":49,"value":4520},"Create ",{"type":43,"tag":218,"props":4522,"children":4524},{"className":4523},[],[4525],{"type":49,"value":4526},"apm-reader",{"type":49,"value":4528}," role with ",{"type":43,"tag":218,"props":4530,"children":4532},{"className":4531},[],[4533],{"type":49,"value":4534},"indices: [{ names: [\"apm-*\"], privileges: [\"read\", \"view_index_metadata\"] }]",{"type":49,"value":82},{"type":43,"tag":117,"props":4537,"children":4538},{},[4539,4545,4546,4552],{"type":43,"tag":218,"props":4540,"children":4542},{"className":4541},[],[4543],{"type":49,"value":4544},"PUT \u002F_security\u002Fuser\u002Falice",{"type":49,"value":745},{"type":43,"tag":218,"props":4547,"children":4549},{"className":4548},[],[4550],{"type":49,"value":4551},"\"roles\": [\"viewer\", \"apm-reader\"]",{"type":49,"value":4553}," (include all roles).",{"type":43,"tag":305,"props":4555,"children":4557},{"id":4556},"grant-a-serverless-user-read-write-access-with-kibana-dashboards",[4558],{"type":49,"value":4559},"Grant a Serverless user read-write access with Kibana dashboards",{"type":43,"tag":52,"props":4561,"children":4562},{},[4563,4567,4569,4575,4577,4583],{"type":43,"tag":63,"props":4564,"children":4565},{},[4566],{"type":49,"value":4349},{"type":49,"value":4568}," \"Give ",{"type":43,"tag":218,"props":4570,"children":4572},{"className":4571},[],[4573],{"type":49,"value":4574},"alice@example.com",{"type":49,"value":4576}," read-write access to the ",{"type":43,"tag":218,"props":4578,"children":4580},{"className":4579},[],[4581],{"type":49,"value":4582},"colors",{"type":49,"value":4584}," index and let her use dashboards and Discover.\"",{"type":43,"tag":679,"props":4586,"children":4587},{},[4588,4657],{"type":43,"tag":117,"props":4589,"children":4590},{},[4591,4593,4599,4601,4606,4608,4614,4615,4621,4622,4628,4630,4635,4636,4641,4643,4649,4650,4656],{"type":49,"value":4592},"Create a custom role via the Kibana API: ",{"type":43,"tag":218,"props":4594,"children":4596},{"className":4595},[],[4597],{"type":49,"value":4598},"PUT \u003CKIBANA_URL>\u002Fapi\u002Fsecurity\u002Frole\u002Fcolors-rw-kibana",{"type":49,"value":4600}," with\n",{"type":43,"tag":218,"props":4602,"children":4604},{"className":4603},[],[4605],{"type":49,"value":4454},{"type":49,"value":4607}," for ",{"type":43,"tag":218,"props":4609,"children":4611},{"className":4610},[],[4612],{"type":49,"value":4613},"read",{"type":49,"value":4277},{"type":43,"tag":218,"props":4616,"children":4618},{"className":4617},[],[4619],{"type":49,"value":4620},"write",{"type":49,"value":4277},{"type":43,"tag":218,"props":4623,"children":4625},{"className":4624},[],[4626],{"type":49,"value":4627},"view_index_metadata",{"type":49,"value":4629}," on ",{"type":43,"tag":218,"props":4631,"children":4633},{"className":4632},[],[4634],{"type":49,"value":4582},{"type":49,"value":669},{"type":43,"tag":218,"props":4637,"children":4639},{"className":4638},[],[4640],{"type":49,"value":4462},{"type":49,"value":4642}," for\n",{"type":43,"tag":218,"props":4644,"children":4646},{"className":4645},[],[4647],{"type":49,"value":4648},"dashboard",{"type":49,"value":4277},{"type":43,"tag":218,"props":4651,"children":4653},{"className":4652},[],[4654],{"type":49,"value":4655},"discover",{"type":49,"value":82},{"type":43,"tag":117,"props":4658,"children":4659},{},[4660,4661,4665,4667,4673],{"type":49,"value":631},{"type":43,"tag":63,"props":4662,"children":4663},{},[4664],{"type":49,"value":636},{"type":49,"value":4666}," skill to assign the user the custom role ",{"type":43,"tag":218,"props":4668,"children":4670},{"className":4669},[],[4671],{"type":49,"value":4672},"colors-rw-kibana",{"type":49,"value":82},{"type":43,"tag":305,"props":4675,"children":4677},{"id":4676},"restrict-hr-data-by-department-dls-fls",[4678],{"type":49,"value":4679},"Restrict HR data by department (DLS + FLS)",{"type":43,"tag":52,"props":4681,"children":4682},{},[4683,4687],{"type":43,"tag":63,"props":4684,"children":4685},{},[4686],{"type":49,"value":4349},{"type":49,"value":4688}," \"Each manager should only see HR records from their own department, and PII fields should be hidden.\"",{"type":43,"tag":679,"props":4690,"children":4691},{},[4692,4710],{"type":43,"tag":117,"props":4693,"children":4694},{},[4695,4697,4703,4704,4709],{"type":49,"value":4696},"Create a user with department metadata: ",{"type":43,"tag":218,"props":4698,"children":4700},{"className":4699},[],[4701],{"type":49,"value":4702},"POST \u002F_security\u002Fuser\u002Fmanager_a",{"type":49,"value":4600},{"type":43,"tag":218,"props":4705,"children":4707},{"className":4706},[],[4708],{"type":49,"value":2990},{"type":49,"value":82},{"type":43,"tag":117,"props":4711,"children":4712},{},[4713],{"type":49,"value":4714},"Create a role with DLS + FLS:",{"type":43,"tag":446,"props":4716,"children":4720},{"className":4717,"code":4718,"language":4719,"meta":451,"style":451},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","PUT \u002F_security\u002Frole\u002Fhr-department-viewer\n{\n  \"description\": \"HR Department Viewer\",\n  \"indices\": [\n    {\n      \"names\": [\"hr-*\"],\n      \"privileges\": [\"read\"],\n      \"field_security\": { \"grant\": [\"*\"], \"except\": [\"ssn\", \"salary\", \"date_of_birth\"] },\n      \"query\": \"{\\\"template\\\": {\\\"source\\\": \\\"{\\\\\\\"term\\\\\\\": {\\\\\\\"department\\\\\\\": \\\\\\\"{{_user.metadata.department}}\\\\\\\"}}\\\"}}\"\n    }\n  ]\n}\n","json",[4721],{"type":43,"tag":218,"props":4722,"children":4723},{"__ignoreMap":451},[4724,4732,4739,4780,4804,4812,4856,4896,5037,5175,5182,5190],{"type":43,"tag":457,"props":4725,"children":4726},{"class":459,"line":460},[4727],{"type":43,"tag":457,"props":4728,"children":4729},{"style":476},[4730],{"type":49,"value":4731},"PUT \u002F_security\u002Frole\u002Fhr-department-viewer\n",{"type":43,"tag":457,"props":4733,"children":4734},{"class":459,"line":841},[4735],{"type":43,"tag":457,"props":4736,"children":4737},{"style":470},[4738],{"type":49,"value":910},{"type":43,"tag":457,"props":4740,"children":4741},{"class":459,"line":867},[4742,4747,4753,4757,4762,4766,4771,4775],{"type":43,"tag":457,"props":4743,"children":4744},{"style":470},[4745],{"type":49,"value":4746},"  \"",{"type":43,"tag":457,"props":4748,"children":4750},{"style":4749},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[4751],{"type":49,"value":4752},"description",{"type":43,"tag":457,"props":4754,"children":4755},{"style":470},[4756],{"type":49,"value":495},{"type":43,"tag":457,"props":4758,"children":4759},{"style":470},[4760],{"type":49,"value":4761},":",{"type":43,"tag":457,"props":4763,"children":4764},{"style":470},[4765],{"type":49,"value":878},{"type":43,"tag":457,"props":4767,"children":4768},{"style":487},[4769],{"type":49,"value":4770},"HR Department Viewer",{"type":43,"tag":457,"props":4772,"children":4773},{"style":470},[4774],{"type":49,"value":495},{"type":43,"tag":457,"props":4776,"children":4777},{"style":470},[4778],{"type":49,"value":4779},",\n",{"type":43,"tag":457,"props":4781,"children":4782},{"class":459,"line":894},[4783,4787,4791,4795,4799],{"type":43,"tag":457,"props":4784,"children":4785},{"style":470},[4786],{"type":49,"value":4746},{"type":43,"tag":457,"props":4788,"children":4789},{"style":4749},[4790],{"type":49,"value":1506},{"type":43,"tag":457,"props":4792,"children":4793},{"style":470},[4794],{"type":49,"value":495},{"type":43,"tag":457,"props":4796,"children":4797},{"style":470},[4798],{"type":49,"value":4761},{"type":43,"tag":457,"props":4800,"children":4801},{"style":470},[4802],{"type":49,"value":4803}," [\n",{"type":43,"tag":457,"props":4805,"children":4806},{"class":459,"line":913},[4807],{"type":43,"tag":457,"props":4808,"children":4809},{"style":470},[4810],{"type":49,"value":4811},"    {\n",{"type":43,"tag":457,"props":4813,"children":4814},{"class":459,"line":942},[4815,4820,4825,4829,4833,4838,4842,4847,4851],{"type":43,"tag":457,"props":4816,"children":4817},{"style":470},[4818],{"type":49,"value":4819},"      \"",{"type":43,"tag":457,"props":4821,"children":4822},{"style":464},[4823],{"type":49,"value":4824},"names",{"type":43,"tag":457,"props":4826,"children":4827},{"style":470},[4828],{"type":49,"value":495},{"type":43,"tag":457,"props":4830,"children":4831},{"style":470},[4832],{"type":49,"value":4761},{"type":43,"tag":457,"props":4834,"children":4835},{"style":470},[4836],{"type":49,"value":4837}," [",{"type":43,"tag":457,"props":4839,"children":4840},{"style":470},[4841],{"type":49,"value":495},{"type":43,"tag":457,"props":4843,"children":4844},{"style":487},[4845],{"type":49,"value":4846},"hr-*",{"type":43,"tag":457,"props":4848,"children":4849},{"style":470},[4850],{"type":49,"value":495},{"type":43,"tag":457,"props":4852,"children":4853},{"style":470},[4854],{"type":49,"value":4855},"],\n",{"type":43,"tag":457,"props":4857,"children":4858},{"class":459,"line":969},[4859,4863,4868,4872,4876,4880,4884,4888,4892],{"type":43,"tag":457,"props":4860,"children":4861},{"style":470},[4862],{"type":49,"value":4819},{"type":43,"tag":457,"props":4864,"children":4865},{"style":464},[4866],{"type":49,"value":4867},"privileges",{"type":43,"tag":457,"props":4869,"children":4870},{"style":470},[4871],{"type":49,"value":495},{"type":43,"tag":457,"props":4873,"children":4874},{"style":470},[4875],{"type":49,"value":4761},{"type":43,"tag":457,"props":4877,"children":4878},{"style":470},[4879],{"type":49,"value":4837},{"type":43,"tag":457,"props":4881,"children":4882},{"style":470},[4883],{"type":49,"value":495},{"type":43,"tag":457,"props":4885,"children":4886},{"style":487},[4887],{"type":49,"value":4613},{"type":43,"tag":457,"props":4889,"children":4890},{"style":470},[4891],{"type":49,"value":495},{"type":43,"tag":457,"props":4893,"children":4894},{"style":470},[4895],{"type":49,"value":4855},{"type":43,"tag":457,"props":4897,"children":4898},{"class":459,"line":995},[4899,4903,4907,4911,4915,4920,4924,4929,4933,4937,4941,4945,4950,4954,4959,4963,4967,4971,4975,4979,4983,4988,4992,4997,5001,5006,5010,5014,5018,5023,5027,5032],{"type":43,"tag":457,"props":4900,"children":4901},{"style":470},[4902],{"type":49,"value":4819},{"type":43,"tag":457,"props":4904,"children":4905},{"style":464},[4906],{"type":49,"value":3065},{"type":43,"tag":457,"props":4908,"children":4909},{"style":470},[4910],{"type":49,"value":495},{"type":43,"tag":457,"props":4912,"children":4913},{"style":470},[4914],{"type":49,"value":4761},{"type":43,"tag":457,"props":4916,"children":4917},{"style":470},[4918],{"type":49,"value":4919}," {",{"type":43,"tag":457,"props":4921,"children":4922},{"style":470},[4923],{"type":49,"value":878},{"type":43,"tag":457,"props":4925,"children":4927},{"style":4926},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[4928],{"type":49,"value":2341},{"type":43,"tag":457,"props":4930,"children":4931},{"style":470},[4932],{"type":49,"value":495},{"type":43,"tag":457,"props":4934,"children":4935},{"style":470},[4936],{"type":49,"value":4761},{"type":43,"tag":457,"props":4938,"children":4939},{"style":470},[4940],{"type":49,"value":4837},{"type":43,"tag":457,"props":4942,"children":4943},{"style":470},[4944],{"type":49,"value":495},{"type":43,"tag":457,"props":4946,"children":4947},{"style":487},[4948],{"type":49,"value":4949},"*",{"type":43,"tag":457,"props":4951,"children":4952},{"style":470},[4953],{"type":49,"value":495},{"type":43,"tag":457,"props":4955,"children":4956},{"style":470},[4957],{"type":49,"value":4958},"],",{"type":43,"tag":457,"props":4960,"children":4961},{"style":470},[4962],{"type":49,"value":878},{"type":43,"tag":457,"props":4964,"children":4965},{"style":4926},[4966],{"type":49,"value":2349},{"type":43,"tag":457,"props":4968,"children":4969},{"style":470},[4970],{"type":49,"value":495},{"type":43,"tag":457,"props":4972,"children":4973},{"style":470},[4974],{"type":49,"value":4761},{"type":43,"tag":457,"props":4976,"children":4977},{"style":470},[4978],{"type":49,"value":4837},{"type":43,"tag":457,"props":4980,"children":4981},{"style":470},[4982],{"type":49,"value":495},{"type":43,"tag":457,"props":4984,"children":4985},{"style":487},[4986],{"type":49,"value":4987},"ssn",{"type":43,"tag":457,"props":4989,"children":4990},{"style":470},[4991],{"type":49,"value":495},{"type":43,"tag":457,"props":4993,"children":4994},{"style":470},[4995],{"type":49,"value":4996},",",{"type":43,"tag":457,"props":4998,"children":4999},{"style":470},[5000],{"type":49,"value":878},{"type":43,"tag":457,"props":5002,"children":5003},{"style":487},[5004],{"type":49,"value":5005},"salary",{"type":43,"tag":457,"props":5007,"children":5008},{"style":470},[5009],{"type":49,"value":495},{"type":43,"tag":457,"props":5011,"children":5012},{"style":470},[5013],{"type":49,"value":4996},{"type":43,"tag":457,"props":5015,"children":5016},{"style":470},[5017],{"type":49,"value":878},{"type":43,"tag":457,"props":5019,"children":5020},{"style":487},[5021],{"type":49,"value":5022},"date_of_birth",{"type":43,"tag":457,"props":5024,"children":5025},{"style":470},[5026],{"type":49,"value":495},{"type":43,"tag":457,"props":5028,"children":5029},{"style":470},[5030],{"type":49,"value":5031},"]",{"type":43,"tag":457,"props":5033,"children":5034},{"style":470},[5035],{"type":49,"value":5036}," },\n",{"type":43,"tag":457,"props":5038,"children":5039},{"class":459,"line":1021},[5040,5044,5048,5052,5056,5060,5065,5070,5075,5079,5084,5088,5093,5097,5102,5106,5110,5115,5120,5124,5128,5132,5136,5140,5144,5148,5153,5157,5162,5166,5170],{"type":43,"tag":457,"props":5041,"children":5042},{"style":470},[5043],{"type":49,"value":4819},{"type":43,"tag":457,"props":5045,"children":5046},{"style":464},[5047],{"type":49,"value":2758},{"type":43,"tag":457,"props":5049,"children":5050},{"style":470},[5051],{"type":49,"value":495},{"type":43,"tag":457,"props":5053,"children":5054},{"style":470},[5055],{"type":49,"value":4761},{"type":43,"tag":457,"props":5057,"children":5058},{"style":470},[5059],{"type":49,"value":878},{"type":43,"tag":457,"props":5061,"children":5062},{"style":487},[5063],{"type":49,"value":5064},"{",{"type":43,"tag":457,"props":5066,"children":5067},{"style":476},[5068],{"type":49,"value":5069},"\\\"",{"type":43,"tag":457,"props":5071,"children":5072},{"style":487},[5073],{"type":49,"value":5074},"template",{"type":43,"tag":457,"props":5076,"children":5077},{"style":476},[5078],{"type":49,"value":5069},{"type":43,"tag":457,"props":5080,"children":5081},{"style":487},[5082],{"type":49,"value":5083},": {",{"type":43,"tag":457,"props":5085,"children":5086},{"style":476},[5087],{"type":49,"value":5069},{"type":43,"tag":457,"props":5089,"children":5090},{"style":487},[5091],{"type":49,"value":5092},"source",{"type":43,"tag":457,"props":5094,"children":5095},{"style":476},[5096],{"type":49,"value":5069},{"type":43,"tag":457,"props":5098,"children":5099},{"style":487},[5100],{"type":49,"value":5101},": ",{"type":43,"tag":457,"props":5103,"children":5104},{"style":476},[5105],{"type":49,"value":5069},{"type":43,"tag":457,"props":5107,"children":5108},{"style":487},[5109],{"type":49,"value":5064},{"type":43,"tag":457,"props":5111,"children":5112},{"style":476},[5113],{"type":49,"value":5114},"\\\\\\\"",{"type":43,"tag":457,"props":5116,"children":5117},{"style":487},[5118],{"type":49,"value":5119},"term",{"type":43,"tag":457,"props":5121,"children":5122},{"style":476},[5123],{"type":49,"value":5114},{"type":43,"tag":457,"props":5125,"children":5126},{"style":487},[5127],{"type":49,"value":5083},{"type":43,"tag":457,"props":5129,"children":5130},{"style":476},[5131],{"type":49,"value":5114},{"type":43,"tag":457,"props":5133,"children":5134},{"style":487},[5135],{"type":49,"value":2998},{"type":43,"tag":457,"props":5137,"children":5138},{"style":476},[5139],{"type":49,"value":5114},{"type":43,"tag":457,"props":5141,"children":5142},{"style":487},[5143],{"type":49,"value":5101},{"type":43,"tag":457,"props":5145,"children":5146},{"style":476},[5147],{"type":49,"value":5114},{"type":43,"tag":457,"props":5149,"children":5150},{"style":487},[5151],{"type":49,"value":5152},"{{_user.metadata.department}}",{"type":43,"tag":457,"props":5154,"children":5155},{"style":476},[5156],{"type":49,"value":5114},{"type":43,"tag":457,"props":5158,"children":5159},{"style":487},[5160],{"type":49,"value":5161},"}}",{"type":43,"tag":457,"props":5163,"children":5164},{"style":476},[5165],{"type":49,"value":5069},{"type":43,"tag":457,"props":5167,"children":5168},{"style":487},[5169],{"type":49,"value":5161},{"type":43,"tag":457,"props":5171,"children":5172},{"style":470},[5173],{"type":49,"value":5174},"\"\n",{"type":43,"tag":457,"props":5176,"children":5177},{"class":459,"line":1030},[5178],{"type":43,"tag":457,"props":5179,"children":5180},{"style":470},[5181],{"type":49,"value":3669},{"type":43,"tag":457,"props":5183,"children":5184},{"class":459,"line":1756},[5185],{"type":43,"tag":457,"props":5186,"children":5187},{"style":470},[5188],{"type":49,"value":5189},"  ]\n",{"type":43,"tag":457,"props":5191,"children":5192},{"class":459,"line":1765},[5193],{"type":43,"tag":457,"props":5194,"children":5195},{"style":470},[5196],{"type":49,"value":5197},"}\n",{"type":43,"tag":52,"props":5199,"children":5200},{},[5201],{"type":49,"value":5202},"The same role works for every department — each user sees only their department's records with PII fields removed.",{"type":43,"tag":106,"props":5204,"children":5206},{"id":5205},"guidelines",[5207],{"type":49,"value":5208},"Guidelines",{"type":43,"tag":305,"props":5210,"children":5212},{"id":5211},"least-privilege-principles",[5213],{"type":49,"value":5214},"Least-privilege principles",{"type":43,"tag":113,"props":5216,"children":5217},{},[5218,5237,5261],{"type":43,"tag":117,"props":5219,"children":5220},{},[5221,5223,5228,5230,5235],{"type":49,"value":5222},"Never use the ",{"type":43,"tag":218,"props":5224,"children":5226},{"className":5225},[],[5227],{"type":49,"value":8},{"type":49,"value":5229}," superuser for day-to-day operations. Create dedicated minimum-privilege roles and reserve\n",{"type":43,"tag":218,"props":5231,"children":5233},{"className":5232},[],[5234],{"type":49,"value":8},{"type":49,"value":5236}," for initial setup and emergency recovery.",{"type":43,"tag":117,"props":5238,"children":5239},{},[5240,5241,5246,5247,5252,5254,5259],{"type":49,"value":1052},{"type":43,"tag":218,"props":5242,"children":5244},{"className":5243},[],[5245],{"type":49,"value":4613},{"type":49,"value":669},{"type":43,"tag":218,"props":5248,"children":5250},{"className":5249},[],[5251],{"type":49,"value":4627},{"type":49,"value":5253}," for read-only data access. Leave ",{"type":43,"tag":218,"props":5255,"children":5257},{"className":5256},[],[5258],{"type":49,"value":1499},{"type":49,"value":5260}," empty unless explicitly required.",{"type":43,"tag":117,"props":5262,"children":5263},{},[5264,5266,5271,5273,5278],{"type":49,"value":5265},"Use DLS (",{"type":43,"tag":218,"props":5267,"children":5269},{"className":5268},[],[5270],{"type":49,"value":2758},{"type":49,"value":5272},") and FLS (",{"type":43,"tag":218,"props":5274,"children":5276},{"className":5275},[],[5277],{"type":49,"value":3065},{"type":49,"value":5279},") to restrict access within an index.",{"type":43,"tag":305,"props":5281,"children":5283},{"id":5282},"named-privileges-only",[5284],{"type":49,"value":5285},"Named privileges only",{"type":43,"tag":52,"props":5287,"children":5288},{},[5289,5291,5297,5299,5305,5306,5312,5314,5320,5321,5327,5329,5333],{"type":49,"value":5290},"Never use internal action names (e.g. ",{"type":43,"tag":218,"props":5292,"children":5294},{"className":5293},[],[5295],{"type":49,"value":5296},"indices:data\u002Fread\u002Fsearch",{"type":49,"value":5298},"). Always use officially documented named privileges.\nPrefer fine-grained privileges (",{"type":43,"tag":218,"props":5300,"children":5302},{"className":5301},[],[5303],{"type":49,"value":5304},"manage_ingest_pipelines",{"type":49,"value":4277},{"type":43,"tag":218,"props":5307,"children":5309},{"className":5308},[],[5310],{"type":49,"value":5311},"monitor",{"type":49,"value":5313},") over broad ones (",{"type":43,"tag":218,"props":5315,"children":5317},{"className":5316},[],[5318],{"type":49,"value":5319},"manage",{"type":49,"value":4277},{"type":43,"tag":218,"props":5322,"children":5324},{"className":5323},[],[5325],{"type":49,"value":5326},"all",{"type":49,"value":5328},"). See\n",{"type":43,"tag":76,"props":5330,"children":5331},{"href":78},[5332],{"type":49,"value":78},{"type":49,"value":5334}," for the full privilege reference tables.",{"type":43,"tag":305,"props":5336,"children":5338},{"id":5337},"role-naming-conventions",[5339],{"type":49,"value":5340},"Role naming conventions",{"type":43,"tag":113,"props":5342,"children":5343},{},[5344,5370,5390],{"type":43,"tag":117,"props":5345,"children":5346},{},[5347,5349,5355,5356,5362,5363,5369],{"type":49,"value":5348},"Use short lowercase names with hyphens: ",{"type":43,"tag":218,"props":5350,"children":5352},{"className":5351},[],[5353],{"type":49,"value":5354},"logs-reader",{"type":49,"value":4277},{"type":43,"tag":218,"props":5357,"children":5359},{"className":5358},[],[5360],{"type":49,"value":5361},"apm-data-viewer",{"type":49,"value":4277},{"type":43,"tag":218,"props":5364,"children":5366},{"className":5365},[],[5367],{"type":49,"value":5368},"metrics-writer",{"type":49,"value":82},{"type":43,"tag":117,"props":5371,"children":5372},{},[5373,5375,5381,5383,5389],{"type":49,"value":5374},"Avoid generic names like ",{"type":43,"tag":218,"props":5376,"children":5378},{"className":5377},[],[5379],{"type":49,"value":5380},"custom-role",{"type":49,"value":5382}," or ",{"type":43,"tag":218,"props":5384,"children":5386},{"className":5385},[],[5387],{"type":49,"value":5388},"new-role",{"type":49,"value":82},{"type":43,"tag":117,"props":5391,"children":5392},{},[5393,5395,5400,5402,5408,5409,5415,5417,5423],{"type":49,"value":5394},"Set ",{"type":43,"tag":218,"props":5396,"children":5398},{"className":5397},[],[5399],{"type":49,"value":4752},{"type":49,"value":5401}," to a short, human-readable display name — not a long sentence. It is shown in the Kibana UI as the\nrole's label. Good: ",{"type":43,"tag":218,"props":5403,"children":5405},{"className":5404},[],[5406],{"type":49,"value":5407},"\"Logs Reader\"",{"type":49,"value":4277},{"type":43,"tag":218,"props":5410,"children":5412},{"className":5411},[],[5413],{"type":49,"value":5414},"\"APM Data Viewer\"",{"type":49,"value":5416},". Bad:\n",{"type":43,"tag":218,"props":5418,"children":5420},{"className":5419},[],[5421],{"type":49,"value":5422},"\"Read-only access to all logs-* indices for the operations team\"",{"type":49,"value":82},{"type":43,"tag":305,"props":5425,"children":5427},{"id":5426},"user-management",[5428],{"type":49,"value":5429},"User management",{"type":43,"tag":113,"props":5431,"children":5432},{},[5433,5460,5465],{"type":43,"tag":117,"props":5434,"children":5435},{},[5436,5438,5444,5446,5452,5453,5459],{"type":49,"value":5437},"Generate strong passwords by default: at least 16 characters mixing uppercase, lowercase, digits, and symbols (e.g.\n",{"type":43,"tag":218,"props":5439,"children":5441},{"className":5440},[],[5442],{"type":49,"value":5443},"X9k#mP2vL!qR7wZn",{"type":49,"value":5445},"). Never use placeholder values like ",{"type":43,"tag":218,"props":5447,"children":5449},{"className":5448},[],[5450],{"type":49,"value":5451},"changeme",{"type":49,"value":5382},{"type":43,"tag":218,"props":5454,"children":5456},{"className":5455},[],[5457],{"type":49,"value":5458},"password123",{"type":49,"value":82},{"type":43,"tag":117,"props":5461,"children":5462},{},[5463],{"type":49,"value":5464},"Prefer disabling users over deleting them to preserve audit trail.",{"type":43,"tag":117,"props":5466,"children":5467},{},[5468,5469,5474,5476,5480],{"type":49,"value":2752},{"type":43,"tag":218,"props":5470,"children":5472},{"className":5471},[],[5473],{"type":49,"value":3118},{"type":49,"value":5475}," array on a user is ",{"type":43,"tag":63,"props":5477,"children":5478},{},[5479],{"type":49,"value":3270},{"type":49,"value":5481}," on update. Always fetch current roles before modifying.",{"type":43,"tag":305,"props":5483,"children":5485},{"id":5484},"role-mapping-best-practices",[5486],{"type":49,"value":5487},"Role mapping best practices",{"type":43,"tag":113,"props":5489,"children":5490},{},[5491,5509,5520,5553],{"type":43,"tag":117,"props":5492,"children":5493},{},[5494,5496,5501,5503,5508],{"type":49,"value":5495},"Use static ",{"type":43,"tag":218,"props":5497,"children":5499},{"className":5498},[],[5500],{"type":49,"value":3118},{"type":49,"value":5502}," for simple, fixed assignments (e.g. all SAML users get ",{"type":43,"tag":218,"props":5504,"children":5506},{"className":5505},[],[5507],{"type":49,"value":4290},{"type":49,"value":539},{"type":43,"tag":117,"props":5510,"children":5511},{},[5512,5513,5518],{"type":49,"value":1052},{"type":43,"tag":218,"props":5514,"children":5516},{"className":5515},[],[5517],{"type":49,"value":3881},{"type":49,"value":5519}," with Mustache only when roles must be derived dynamically from user attributes.",{"type":43,"tag":117,"props":5521,"children":5522},{},[5523,5525,5530,5531,5537,5538,5544,5546,5551],{"type":49,"value":5524},"Combine ",{"type":43,"tag":218,"props":5526,"children":5528},{"className":5527},[],[5529],{"type":49,"value":5326},{"type":49,"value":4277},{"type":43,"tag":218,"props":5532,"children":5534},{"className":5533},[],[5535],{"type":49,"value":5536},"any",{"type":49,"value":4277},{"type":43,"tag":218,"props":5539,"children":5541},{"className":5540},[],[5542],{"type":49,"value":5543},"field",{"type":49,"value":5545},", and ",{"type":43,"tag":218,"props":5547,"children":5549},{"className":5548},[],[5550],{"type":49,"value":2349},{"type":49,"value":5552}," rules to express complex conditions without duplicating mappings.",{"type":43,"tag":117,"props":5554,"children":5555},{},[5556,5558,5564],{"type":49,"value":5557},"Test new mappings with ",{"type":43,"tag":218,"props":5559,"children":5561},{"className":5560},[],[5562],{"type":49,"value":5563},"enabled: false",{"type":49,"value":5565}," first, then enable once verified.",{"type":43,"tag":106,"props":5567,"children":5569},{"id":5568},"deployment-compatibility",[5570],{"type":49,"value":102},{"type":43,"tag":52,"props":5572,"children":5573},{},[5574,5575,5580],{"type":49,"value":4089},{"type":43,"tag":76,"props":5576,"children":5578},{"href":5577},"references\u002Fdeployment-compatibility.md",[5579],{"type":49,"value":5577},{"type":49,"value":5581}," for a feature matrix and detailed\nnotes on self-managed, ECH, and Serverless deployment differences.",{"type":43,"tag":5583,"props":5584,"children":5585},"style",{},[5586],{"type":49,"value":5587},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":5589,"total":5745},[5590,5609,5625,5638,5654,5666,5676,5689,5700,5715,5725,5732],{"slug":5591,"name":5591,"fn":5592,"description":5593,"org":5594,"tags":5595,"stars":5606,"repoUrl":5607,"updatedAt":5608},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5596,5599,5602,5603],{"name":5597,"slug":5598,"type":15},"Analytics","analytics",{"name":5600,"slug":5601,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":5604,"slug":5605,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":5610,"name":5610,"fn":5611,"description":5612,"org":5613,"tags":5614,"stars":5606,"repoUrl":5607,"updatedAt":5624},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5615,5618,5619,5621],{"name":5616,"slug":5617,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":5620,"slug":3006,"type":15},"Engineering",{"name":5622,"slug":5623,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":5626,"name":5626,"fn":5627,"description":5628,"org":5629,"tags":5630,"stars":5606,"repoUrl":5607,"updatedAt":5637},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5631,5632,5633,5634],{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":5604,"slug":5605,"type":15},{"name":5635,"slug":5636,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":636,"name":636,"fn":5639,"description":5640,"org":5641,"tags":5642,"stars":23,"repoUrl":24,"updatedAt":5653},"manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5643,5646,5647,5650],{"name":5644,"slug":5645,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":5648,"slug":5649,"type":15},"Operations","operations",{"name":5651,"slug":5652,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":5655,"name":5655,"fn":5656,"description":5657,"org":5658,"tags":5659,"stars":23,"repoUrl":24,"updatedAt":5665},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5660,5661,5664],{"name":5644,"slug":5645,"type":15},{"name":5662,"slug":5663,"type":15},"Deployment","deployment",{"name":21,"slug":22,"type":15},"2026-07-12T07:46:42.353362",{"slug":5667,"name":5667,"fn":5668,"description":5669,"org":5670,"tags":5671,"stars":23,"repoUrl":24,"updatedAt":5675},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5672,5673,5674],{"name":5644,"slug":5645,"type":15},{"name":21,"slug":22,"type":15},{"name":5648,"slug":5649,"type":15},"2026-07-12T07:46:41.097412",{"slug":5677,"name":5677,"fn":5678,"description":5679,"org":5680,"tags":5681,"stars":23,"repoUrl":24,"updatedAt":5688},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5682,5683,5684,5687],{"name":5644,"slug":5645,"type":15},{"name":21,"slug":22,"type":15},{"name":5685,"slug":5686,"type":15},"Networking","networking",{"name":13,"slug":14,"type":15},"2026-07-12T07:46:43.675992",{"slug":5690,"name":5690,"fn":5691,"description":5692,"org":5693,"tags":5694,"stars":23,"repoUrl":24,"updatedAt":5699},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5695,5697,5698],{"name":252,"slug":5696,"type":15},"authentication",{"name":5644,"slug":5645,"type":15},{"name":21,"slug":22,"type":15},"2026-07-12T07:46:39.783105",{"slug":5701,"name":5701,"fn":5702,"description":5703,"org":5704,"tags":5705,"stars":23,"repoUrl":24,"updatedAt":5714},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5706,5709,5710,5713],{"name":5707,"slug":5708,"type":15},"Audit","audit",{"name":21,"slug":22,"type":15},{"name":5711,"slug":5712,"type":15},"Logs","logs",{"name":13,"slug":14,"type":15},"2026-07-12T07:47:35.092599",{"slug":67,"name":67,"fn":5716,"description":5717,"org":5718,"tags":5719,"stars":23,"repoUrl":24,"updatedAt":5724},"configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5720,5721,5722,5723],{"name":252,"slug":5696,"type":15},{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},"2026-07-12T07:47:41.474547",{"slug":4,"name":4,"fn":5,"description":6,"org":5726,"tags":5727,"stars":23,"repoUrl":24,"updatedAt":25},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5728,5729,5730,5731],{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":18,"slug":19,"type":15},{"name":13,"slug":14,"type":15},{"slug":5733,"name":5733,"fn":5734,"description":5735,"org":5736,"tags":5737,"stars":23,"repoUrl":24,"updatedAt":5744},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5738,5739,5740,5741],{"name":5597,"slug":5598,"type":15},{"name":5600,"slug":5601,"type":15},{"name":21,"slug":22,"type":15},{"name":5742,"slug":5743,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":5747,"total":5794},[5748,5755,5761,5767,5774,5780,5787],{"slug":636,"name":636,"fn":5639,"description":5640,"org":5749,"tags":5750,"stars":23,"repoUrl":24,"updatedAt":5653},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5751,5752,5753,5754],{"name":5644,"slug":5645,"type":15},{"name":9,"slug":8,"type":15},{"name":5648,"slug":5649,"type":15},{"name":5651,"slug":5652,"type":15},{"slug":5655,"name":5655,"fn":5656,"description":5657,"org":5756,"tags":5757,"stars":23,"repoUrl":24,"updatedAt":5665},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5758,5759,5760],{"name":5644,"slug":5645,"type":15},{"name":5662,"slug":5663,"type":15},{"name":21,"slug":22,"type":15},{"slug":5667,"name":5667,"fn":5668,"description":5669,"org":5762,"tags":5763,"stars":23,"repoUrl":24,"updatedAt":5675},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5764,5765,5766],{"name":5644,"slug":5645,"type":15},{"name":21,"slug":22,"type":15},{"name":5648,"slug":5649,"type":15},{"slug":5677,"name":5677,"fn":5678,"description":5679,"org":5768,"tags":5769,"stars":23,"repoUrl":24,"updatedAt":5688},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5770,5771,5772,5773],{"name":5644,"slug":5645,"type":15},{"name":21,"slug":22,"type":15},{"name":5685,"slug":5686,"type":15},{"name":13,"slug":14,"type":15},{"slug":5690,"name":5690,"fn":5691,"description":5692,"org":5775,"tags":5776,"stars":23,"repoUrl":24,"updatedAt":5699},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5777,5778,5779],{"name":252,"slug":5696,"type":15},{"name":5644,"slug":5645,"type":15},{"name":21,"slug":22,"type":15},{"slug":5701,"name":5701,"fn":5702,"description":5703,"org":5781,"tags":5782,"stars":23,"repoUrl":24,"updatedAt":5714},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5783,5784,5785,5786],{"name":5707,"slug":5708,"type":15},{"name":21,"slug":22,"type":15},{"name":5711,"slug":5712,"type":15},{"name":13,"slug":14,"type":15},{"slug":67,"name":67,"fn":5716,"description":5717,"org":5788,"tags":5789,"stars":23,"repoUrl":24,"updatedAt":5724},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[5790,5791,5792,5793],{"name":252,"slug":5696,"type":15},{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},{"name":13,"slug":14,"type":15},35]