search filter limit for user

[duongl2]

I just want esrs user see only esrs index,but it has no data
if i command the srchfilter out. the user see all indexes.
thanks

this is my authorize.conf

role_esrs
rtsearch = enable
srchFilter = host=host*
importRoles = user
rtSrchJobsQuota = 0
srchDiskQuota = 0
srchIndexesAllowed = index
srchIndexesDefault = index
srchJobsQuota = 0

[nurtdi]

That worked for me! Thank you, Joetron

[RicoSuave]

I think your issue here is that you are also importing the user role. And that role allows users to search all non internal indexes by default. Try removing that role from the inhereted list, then tweak the esrs role. You shouldn't have to use any search restrictions to achieve this.

[RicoSuave]

Yeah, that's because the user role has the REST_Properties Capabilities to allow the users to access it via web. An easier approach would be to just remove the all of the indexes in selected search indexes in the user role, then just specify what indexes the other roles can search. Or you could add the REST capabilities to the esrs role.

[duongl2]

if i remove user role, i got an error when login
Internal Server Error

AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS/test/search/properties/app?fillcontents=1

[duongl2]

i use srchFilter = index=esrs.
it is ok. but i am not sure that is correct. because the user can't see others indexes. How is about the dashboard and view. The user still see all sources and hosts.