title: ElasticSearch / Kibana: read-only user privileges
body: <p>In our current system, we are going to create logs in ElasticSearch, which we'll access through Kibana.</p>
  
  <p>The system will use two separate indices; <code>info</code> and <code>error</code>, where <code>info</code> is pretty much an event log. The <code>error</code> index is the system's de-facto error log.</p>
  
  <p>Now, I'm trying to create a <code>marketing</code> user so that their staff can create graphs etc in Kibana based on the events from the info index. They should only have read access obviously, and only access to the <code>info</code> index.</p>
  
  <p>This is what I've got so far:</p>
  
  <p>Role configuration:</p>
  
  <pre><code>PUT /_xpack/security/role/marketing
  {
    "cluster": [
      "transport_client"
    ],
    "indices": [
      {
        "names": [
          "info"
        ],
        "privileges": [
          "read"
        ]
      }
    ]
  }
  </code></pre>
  
  <p>User configuration:</p>
  
  <pre><code>POST /_xpack/security/user/marketing
  {
    "password" : "mypassword",
    "roles" : [ "marketing" ],
    "full_name" : "Colin Prefect",
    "email" : "info@pensionera.se"
  }
  </code></pre>
  
  <p>When I log in with the <code>marketing</code>-user in Kibana to try to query some data, I get this error message:</p>
  
  <p><code>Config: Error 403 Forbidden: action [indices:data/write/update] is unauthorized for user [marketing]: [security_exception] action [indices:data/write/update] is unauthorized for user [marketing]</code></p>
  
  <p>All the panes in Kibana, except the left menu and this error message at the top, are blank white.</p>
  
  <p>I obviously don't want to add those privileges to the marketing user, so what is the proper way of tackling this problem?</p>
  
  <p>Thanks for your time.</p>