User access to _internal

[L_Petch]

Hello,

I need to give certain users access to _internal but only allow them to see certain hosts. I planned to do this by adding a new role, giving them access to the index and then limiting them to the hosts in the search filter section. This works however it restricts access in all other indexes they have access to, to the same search filter even though this isn't inherited and access granted by a separate role.

Is there an easier/better way of doing this?

[L_Petch]

Hi @gcusello 

How does this stop the filter from stopping access to all the other indexers the user has access to? As soon as I add the filter " host::spl001 OR host::spl002 " for example it will apply this restriction to all indexes not jus the _internal I want it to wont it?

[gcusello · Accepted solution]

hi @L_Petch ,

use as filter:

index=* OR (index=_internal host IN (spl001,spl002))

Ciao.

Giuseppe

[L_Petch]

@gcusello thanks that is exactly what I needed 

[gcusello]

Hi @L_Petch ,

to create the new role don't use Inheritation but clone the role from another one and modify the search filters.

Ciao.

Giuseppe