If some data should only be seen by a specific set of users, the most effective way to limit access is to place this data in a different index, and then limit access to that index by using a role. The steps to accomplish this are essentially as follows:
- Define the new index.
- Configure inputs.conf or transforms.conf to send these events to the new index.
- Ensure that the user role does not have access to the new index.
- Create a new role that has access to the new index.
- Add specific users to this new role. If you are using LDAP authentication, you will need to map the role to an LDAP group and add users to that LDAP group.
To route very specific events to this new index, assuming you created an index called sensitive ...
