Here are the related logs:
kibana :
{
"type": "response",
"@timestamp": "2021-07-05T13:50:30+02:00",
"tags": [],
"pid": 9,
"method": "post",
"statusCode": 403,
"req": {
"url": "/api/saved_objects/_import?overwrite=true",
"method": "post",
"headers": {
"user-agent": "python-requests/2.25.1",
"accept-encoding": "gzip, deflate",
"accept": "*/*",
"kbn-xsrf": "true",
"x-kibana-index": "kibana_vgfg7119",
"content-type": "multipart/form-data; boundary=dd4b6a7c451e8a3d0ce1e39a43a95229",
"host": "<redacted>",
"x-forwarded-host": "<redacted>",
"x-forwarded-port": "443",
"x-forwarded-proto": "https",
"forwarded": "for=<REDACTED>;host=<REDACTED>;proto=https",
"x-forwarded-for": "1<REDACTED>",
"connection": "close",
"x-ror-pkp-kibana-token": "5mztptcrljg5opoxvg4zs40rd2suwx",
"transfer-encoding": "chunked"
},
"remoteAddress": "127.0.0.1",
"userAgent": "python-requests/2.25.1"
},
"res": {
"statusCode": 403,
"responseTime": 2524,
"contentLength": 76
},
"message": "POST /api/saved_objects/_import?overwrite=true 403 2524ms - 76.0B"
}
Elasticsearch :
{
"type": "server",
"timestamp": "2021-07-05T13:50:32,146+02:00",
"level": "INFO",
"component": "t.b.r.a.l.AccessControlLoggingDecorator",
"cluster.name": "elastic-cluster",
"node.name": "elasticsearch-22-m289f",
"message": "\u001B[36mALLOWED by { name: '::Import::Export tool ::', policy: ALLOW, rules: [auth_key_sha512,kibana_index,kibana_access,indices] req={ ID:1635327142-1236962386#55880, TYP:MultiGetRequest, CGR:N/A, USR:import, BRS:true, KDX:.kibana_mylogin, ACT:indices:data/read/mget, OA:<REDACTED>/32, XFF:<REDACTED>, DA:<REDACTED>/32, IDX:.kibana_7.12.1, MET:POST, PTH:/_mget, CNT:<OMITTED, LENGTH=19764.0 B> , HDR:Authorization=<OMITTED>, Connection=keep-alive, Host=<redacted>.svc:9200, content-length=19764, content-type=application/json, cookie=rorCookie=<redacted>, user-agent=elasticsearch-js/7.12.0-canary.7 (linux 3.10.0-957.12.2.el7.x86_64-x64; Node.js v14.16.1), x-elastic-client-meta=es=7.12.0p,js=14.16.1,t=7.12.0p,hc=14.16.1, x-elastic-product-origin=kibana, x-forwarded-for=<redacted>, x-kibana-index=kibana_mylogin, x-opaque-id=a6477b39-0db2-4a39-8a37-68ef0534949c, x-ror-kibana-request-method=post, x-ror-kibana-request-path=/api/saved_objects/_import, HIS:[Allow HealthCheck-> RULES:[methods->false] RESOLVED:[indices=.kibana_7.12.1]], [::ADMIN::-> RULES:[auth_key_sha512->false] RESOLVED:[indices=.kibana_7.12.1]], [::KIBANA::-> RULES:[auth_key_sha512->false] RESOLVED:[indices=.kibana_7.12.1]], [::Import::Export tool ::-> RULES:[auth_key_sha512->true, kibana_index->true, kibana_access->true, indices->true] RESOLVED:[user=import;indices=.kibana_7.12.1;kibana_idx=.kibana_mylogin]], }\u001B[0m",
"cluster.uuid": "jS0Y755BQwSgcPyWEQ1OdQ",
"node.id": "GVxz7Mt7QQaW2X6PfKy59Q"
}{
"type": "server",
"timestamp": "2021-07-05T13:50:32,490+02:00",
"level": "INFO",
"component": "t.b.r.a.l.AccessControlLoggingDecorator",
"cluster.name": "elastic-cluster",
"node.name": "elasticsearch-22-m289f",
"message": "\u001B[35mFORBIDDEN by default req={ ID:14444974-832283029#55883, TYP:BulkRequest, CGR:N/A, USR:import (attempted), BRS:true, KDX:null, ACT:indices:data/write/bulk, OA:<REDACTED>/32, XFF:<REDACTED>, DA:<REDACTED>/32, IDX:.kibana_7.12.1, MET:POST, PTH:/_bulk, CNT:<OMITTED, LENGTH=5826902.0 B> , HDR:Authorization=<OMITTED>, Connection=keep-alive, Host=<redacted>:9200, content-length=5826902, content-type=application/x-ndjson, cookie=rorCookie=REDACTED, user-agent=elasticsearch-js/7.12.0-canary.7 (linux 3.10.0-957.12.2.el7.x86_64-x64; Node.js v14.16.1), x-elastic-client-meta=es=7.12.0p,js=14.16.1,t=7.12.0p,hc=14.16.1, x-elastic-product-origin=kibana, x-forwarded-for=<REDACTED>, x-kibana-index=kibana_mylogin, x-opaque-id=a6477b39-0db2-4a39-8a37-68ef0534949c, x-ror-kibana-request-method=post, x-ror-kibana-request-path=/api/saved_objects/_import, HIS:[Allow HealthCheck-> RULES:[methods->false] RESOLVED:[indices=.kibana_7.12.1]], [::ADMIN::-> RULES:[auth_key_sha512->false] RESOLVED:[indices=.kibana_7.12.1]], [::KIBANA::-> RULES:[auth_key_sha512->false] RESOLVED:[indices=.kibana_7.12.1]], [::Import::Export tool ::-> RULES:[auth_key_sha512->true, kibana_index->true, kibana_access->false] RESOLVED:[user=import;indices=.kibana_7.12.1;kibana_idx=.kibana_mylogin]], [::Allow access to create short urls::-> RULES:[ror_kbn_auth->false] RESOLVED:[indices=.kibana_7.12.1]], }\u001B[0m",
"cluster.uuid": "jS0Y755BQwSgcPyWEQ1OdQ",
"node.id": "GVxz7Mt7QQaW2X6PfKy59Q"
}
Related configuration :
- name: "::Import::Export tool ::"
kibana_access: "rw"
verbosity: info
auth_key_sha512: "import:<REDACTED>"
indices: [".kibana*"]
kibana_index: ".@{header:X-Kibana-Index}"
Enhancement (ES) 