[2026-07-06T16:22:10,100] [ae7105f7-e44c-4ef3-b14a-2e8f007f6ad9-1460742259#62653267] FORBIDDEN by { name: 'China forbid user', policy: FORBID, rules: [ldap_authentication, ldap_authorization] } req={ ID:ae7105f7-e44c-4ef3-b14a-2e8f007f6ad9-1460742259#62653267, TYP:SearchRequest, CGR:<N/A>, USR:grafana.elk (attempted), BRS:true, ACT:indices:data/read/search, OA:10.13.15.199/32, XFF:null, DA:10.13.39.75/32, IDX:*asdasd, MET:GET, PTH:/*asdasd/_search, CNT:<N/A>, HDR:Host=sjc01-c02-kcs20:9200, Accept=*/*, content-length=0, User-Agent=curl/8.7.1, Authorization=<OMITTED>, HIS:[Test2: NOT_MATCHED (IDX_NOT_FOUND) -> RULES:[ldap_authentication->true, users->true, indices->false]], [Allow unrestricted access to ACL-APP-Kibana-Admin users: NOT_MATCHED (GROUPS_AUTH_FAIL (None of the user's groups match the configured groups)) -> RULES:[ldap_authentication->true, ldap_authorization->false]], [.readonlyrest forbid: NOT_MATCHED (AUTHZ_FAIL) -> RULES:[actions->false]], [access painless: NOT_MATCHED (AUTHZ_FAIL) -> RULES:[actions->false]], [kibana_system: NOT_MATCHED (AUTH_FAIL (Username mismatch)) -> RULES:[auth_key_sha512->false]], [rehydrator: NOT_MATCHED (AUTH_FAIL (Username mismatch)) -> RULES:[auth_key_sha512->false]], [apm_central_config: NOT_MATCHED (AUTH_FAIL (Username mismatch)) -> RULES:[auth_key_sha512->false]], [logstash pass: NOT_MATCHED (AUTH_FAIL (Username mismatch)) -> RULES:[auth_key_sha512->false]], [Access delete doc: NOT_MATCHED (AUTHZ_FAIL) -> RULES:[ldap_authentication->true, actions->false]], [China user: NOT_MATCHED (IDX_NOT_FOUND) -> RULES:[ldap_authentication->true, ldap_authorization->true, kibana_hide_apps->true, kibana_access->true, indices->false]], [China elevated user: NOT_MATCHED (GROUPS_AUTH_FAIL (None of the user's groups match the configured groups)) -> RULES:[ldap_authentication->true, ldap_authorization->false]], [China forbid user: MATCHED -> RULES:[ldap_authentication->true, ldap_authorization->true] RESOLVED:[user=grafana.elk;group=ACL-APP-Kibana-NO-PII;av_groups=ACL-APP-Kibana-NO-PII;indices=*asdasd]], }