Edit query DSL not available in Kibana with RO profile

1

Hello !
RoR enterprise 1.40.0-pre / Kibana + Els 7.16.3

During my tests, I discovered that the edit as query DSL feature was not available for users with a RO profile. Is this something expected?

image
image844Ă—635 23.7 KB

2

Yeah you can’t save a query as RO at the moment. Do you feel this is wrong?

3

It’s at least confusing:
the edit filter value feature is enabled for RO profiles, but not the edit query dsl while they share the same GUI overlay and overall goal : filter results in discover mode.

I’m not talking about the “save search” feature which should be disabled for RO profiles(as it is right now). But if I infer well, to enable “edit query dsl” implies update “saved search” in back office?

4

I had a look: this is the excerpt of the Kibana capabilities API, as we tweaked it for RO users in the discover app:

"discover": {
    "createShortUrl": false,
    "save": false,
    "saveQuery": false,
    "show": true,
    "storeSearchSession": true
  }

As you can see we don’t have many knobs to turn: it’s either we let RO users save the queries or not. I’d rather say that it’s unexpected that you can save regular filters at all.

In general, I agree with you that if they grant me the permission to save a regular filter, then I’d expect I can create the QueryDSL variant of a filter as well. But at the same time I’d see it as an intentional compromise: with the Query DSL there would be way too much freedom to DDOS the cluster.

1 Like
5

This absolutely makes sense . Thank you very much for the explanation.

1 Like