Is user-based data masking possible for one-index .

[isha_rastogi]

I have different users who will be accessing a index. Problem is I want User "A" to access the original data but for User "B" data would be masked for same index. I tried to create the Python script to mask the information but how to invoke the script on user-session.

[renjith_nair]

User role is assigned on index level and hence all or none will be affected. There are two ways you can try

1. Forward data simultaneously to another index with and mask it (License meter counts)
2. Run a search to populate a summary index from the original one after masking and give the user access to only summary index (no extra license needed)

[isha_rastogi]

What if user wants to see raw events with masked data? I believe summary indexing will be able to produce report or search for fields which are creating summary index.