WARNING: Version 5.2 of the Elastic Stack has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

› › ›

Security Privileges

edit

Security Privileges

edit

This section lists the privileges that you can assign to a role.

Cluster Privileges

edit

`all`	All cluster administration operations, like snapshotting, node shutdown/restart, settings update, rerouting, or managing users and roles.
`monitor`	All cluster read-only operations, like cluster health and state, hot threads, node info, node and cluster stats, and pending cluster tasks.
`manage`	Builds on `monitor` and adds cluster operations that change values in the cluster. This includes snapshotting, updating settings, and rerouting. It also includes obtaining snapshot and restore status. This privilege does not include the ability to manage security.
`manage_security`	All security related operations such as CRUD operations on users and roles and cache clearing.
`manage_index_templates`	All operations on index templates.
`manage_pipeline`	All operations on ingest pipelines.
`transport_client`	All privileges necessary for a transport client to connect.

Indices Privileges

edit

`all`	Any action on an index
`monitor`	All actions that are required for monitoring (recovery, segments info, index stats and status).
`manage`	All `monitor` privileges plus index administration (aliases, analyze, cache clear, close, delete, exists, flush, mapping, open, force merge, refresh, settings, search shards, templates, validate).
`view_index_metadata`	Read-only access to index metadata (aliases, aliases exists, get index, exists, field mappings, mappings, search shards, type exists, validate, warmers, settings). This privilege is primarily available for use by Kibana users.
`read`	Read only access to actions (count, explain, get, mget, get indexed scripts, more like this, multi percolate/search/termvector, percolate, scroll, clear_scroll, search, suggest, tv).
`index`	Privilege to index and update documents. Also grants access to the update mapping action.
`create`	Privilege to index documents. Also grants access to the update mapping action.
`delete`	Privilege to delete documents.
`write`	Privilege to perform all write operations to documents, which includes the permission to index, update, and delete documents as well as performing bulk operations. Also grants access to the update mapping action.
`delete_index`	Privilege to delete an index.
`create_index`	Privilege to create an index. A create index request may contain aliases to be added to the index once created. In that case the request requires the `manage` privilege as well, on both the index and the aliases names.

Run As Privilege

edit

The run_as permission enables an authenticated user to submit requests on behalf of another user. The value can be a user name or a comma-separated list of user names. (You can also specify users as an array of strings or a YAML sequence.) For more information, see Submitting Requests on Behalf of Other Users.

« Reference Security Files »