- X-Pack Reference for 6.0-6.2 and 5.x:
- Introduction
- Setting Up X-Pack
- Breaking Changes
- X-Pack APIs
- Graphing Connections in Your Data
- Profiling your Queries and Aggregations
- Reporting from Kibana
- Securing the Elastic Stack
- Getting Started with Security
- How Security Works
- Setting Up User Authentication
- Configuring SAML Single-Sign-On on the Elastic Stack
- Configuring Role-based Access Control
- Auditing Security Events
- Encrypting Communications
- Restricting Connections with IP Filtering
- Cross Cluster Search, Tribe, Clients and Integrations
- Reference
- Monitoring the Elastic Stack
- Alerting on Cluster and Index Events
- Machine Learning in the Elastic Stack
- Troubleshooting
- Getting Help
- X-Pack security
- Can’t log in after upgrading to 6.2.4
- Some settings are not returned via the nodes settings API
- Authorization exceptions
- Users command fails due to extra arguments
- Users are frequently locked out of Active Directory
- Certificate verification fails for curl on Mac
- SSLHandshakeException causes connections to fail
- Common SSL/TLS exceptions
- Internal Server Error in Kibana
- Setup-passwords command fails due to connection failure
- X-Pack Watcher
- X-Pack monitoring
- X-Pack machine learning
- Limitations
- License Management
- Release Notes
WARNING: Version 6.2 of the Elastic Stack has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Built-in Roles
editBuilt-in Roles
editX-Pack security applies a default role to all users, including anonymous users. The default role enables users to access the authenticate endpoint, change their own passwords, and get information about themselves.
X-Pack security also provides a set of built-in roles you can explicitly assign to users. These roles have a fixed set of privileges and cannot be updated.
-
ingest_admin
-
Grants access to manage all index templates and all ingest pipeline configurations.
This role does not provide the ability to create indices; those privileges must be defined in a separate role.
-
kibana_dashboard_only_user
-
Grants access to the Kibana Dashboard and read-only permissions on the
.kibana
index. This role does not have access to editing tools in Kibana. For more information, see Kibana Dashboard Only Mode. -
kibana_system
-
Grants access necessary for the Kibana system user to read from and write to the Kibana indices, manage index templates, and check the availability of the Elasticsearch cluster. This role grants read access to the
.monitoring-*
indices and read and write access to the.reporting-*
indices. For more information, see Configuring Security in Kibana.This role should not be assigned to users as the granted permissions may change between releases.
-
kibana_user
- Grants the minimum privileges required for any user of Kibana. This role grants access to the Kibana indices and grants monitoring privileges for the cluster.
-
logstash_admin
-
Grants access to the
.logstash*
indices for managing configurations. -
logstash_system
-
Grants access necessary for the Logstash system user to send system-level data (such as monitoring) to Elasticsearch. For more information, see Configuring Security in Logstash.
This role should not be assigned to users as the granted permissions may change between releases.
This role does not provide access to the logstash indices and is not suitable for use within a Logstash pipeline.
-
machine_learning_admin
-
Grants
manage_ml
cluster privileges and read access to the.ml-*
indices. -
machine_learning_user
-
Grants the minimum privileges required to view X-Pack machine learning configuration,
status, and results. This role grants
monitor_ml
cluster privileges and read access to the.ml-notifications
and.ml-anomalies*
indices, which store machine learning results. -
monitoring_user
-
Grants the minimum privileges required for any user of X-Pack monitoring other than those
required to use Kibana. This role grants access to the monitoring indices.
Monitoring users should also be assigned the
kibana_user
role. -
remote_monitoring_agent
- Grants the minimum privileges required for a remote monitoring agent to write data into this cluster.
-
reporting_user
-
Grants the specific privileges required for users of X-Pack reporting other than those
required to use Kibana. This role grants access to the reporting indices. Reporting
users should also be assigned the
kibana_user
role and a role that grants them access to the data that will be used to generate reports with. -
superuser
-
Grants full access to the cluster, including all indices and data. A user with
the
superuser
role can also manage users and roles and impersonate any other user in the system. Due to the permissive nature of this role, take extra care when assigning it to a user. -
transport_client
-
Grants the privileges required to access the cluster through the Java Transport Client. The Java Transport Client fetches information about the nodes in the cluster using the Node Liveness API and the Cluster State API (when sniffing is enabled). Assign your users this role if they use the Transport Client.
Using the Transport Client effectively means the users are granted access to the cluster state. This means users can view the metadata over all indices, index templates, mappings, node and basically everything about the cluster. However, this role does not grant permission to view the data in all indices.
-
watcher_admin
-
Grants write access to the
.watches
index, read access to the watch history and the triggered watches index and allows to execute all watcher actions. -
watcher_user
-
Grants read access to the
.watches
index, the get watch action and the watcher stats.
ElasticON events are back!
Learn about the Elastic Search AI Platform from the experts at our live events.
Register now