--- _meta: type: "roles" config_version: 2 opendistro_security_fls_exists: cluster_permissions: - "*" index_permissions: - index_patterns: - "data" allowed_actions: - "*" fls: - "@timestamp" - "host" #- "non-existing" opendistro_security_date_math: index_permissions: - index_patterns: - 'logstash' dls: '{"range":{"@timestamp":{"from":"now-1d","to":"now","format":"strict_date_optional_time","include_lower":true,"include_upper":true,"boost":1.0}}}' allowed_actions: - "*" opendistro_security_bbb: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: [] index_permissions: - index_patterns: - "aaa" dls: "{\"term\" : {\"type\" : \"a\"}}" fls: - "f2" - "f3" - "f4" - "type" masked_fields: null allowed_actions: - "*" - index_patterns: - "bbb" dls: "{\"term\" : {\"type\" : \"b\"}}" fls: - "f1" - "f2" - "type" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_fls_fields_wc: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "de*" dls: null fls: - "nonexistant" - "amount" - "zip" - "*field*" masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" tenant_permissions: [] opendistro_security_aaa: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: [] index_permissions: - index_patterns: - "aaa" dls: "{\"term\" : {\"type\" : \"a\"}}" fls: - "f1" - "f2" - "type" masked_fields: null allowed_actions: - "*" - index_patterns: - "bbb" dls: "{\"term\" : {\"type\" : \"b\"}}" fls: - "f2" - "f3" - "f4" - "type" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_perf_wc_in: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: null fls: - "field5*" - "field9*" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_fls_fields: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: null fls: - "nonexistant" - "amount" - "zip" - "*field*" masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" tenant_permissions: [] opendistro_security_masked: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "*" dls: null fls: null masked_fields: - "*ip*" allowed_actions: - "indices:data/read/*" tenant_permissions: [] opendistro_security_dls_without_field_perm: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: "{\n \"range\" : {\n \"amount\" : {\n \"gte\" : 1000,\n \ \ \"lte\" : 20000\n }\n }\n}\n" fls: - "customer.*" - "zip" masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" tenant_permissions: [] opendistro_security_dls_multi2: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: "{\n \"range\" : {\n \"amount\" : {\n \"gte\" : 5,\n \ \ \"lte\" : 300\n }\n }\n}\n" fls: - "customer.*" - "amount" - "zip" masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" tenant_permissions: [] opendistro_security_perf_named_ex: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: null fls: - "~field3" - "~field4" - "~field5" - "~field6" - "~field7" - "~field8" - "~field9" - "~field10" - "~field11" - "~field12" - "~field13" - "~field14" - "~field15" - "~field16" - "~field17" - "~field18" - "~field19" - "~field20" - "~field21" - "~field22" - "~field23" - "~field24" - "~field25" - "~field26" - "~field27" - "~field28" - "~field29" - "~field30" - "~field31" - "~field32" - "~field33" - "~field34" - "~field35" - "~field36" - "~field37" - "~field38" - "~field39" - "~field40" - "~field41" - "~field42" - "~field43" - "~field44" - "~field45" - "~field46" - "~field47" - "~field48" - "~field49" - "~field50" - "~field51" - "~field52" - "~field53" - "~field54" - "~field55" - "~field56" - "~field57" - "~field58" - "~field59" - "~field60" - "~field61" - "~field62" - "~field63" - "~field64" - "~field65" - "~field66" - "~field67" - "~field68" - "~field69" - "~field70" - "~field71" - "~field72" - "~field73" - "~field74" - "~field75" - "~field76" - "~field77" - "~field78" - "~field79" - "~field80" - "~field81" - "~field82" - "~field83" - "~field84" - "~field85" - "~field86" - "~field87" - "~field88" - "~field89" - "~field90" - "~field91" - "~field92" - "~field93" - "~field94" - "~field95" - "~field96" - "~field97" - "~field98" - "~field99" - "~field100" - "~field101" - "~field102" - "~field103" - "~field104" - "~field105" - "~field106" - "~field107" - "~field108" - "~field109" - "~field110" - "~field111" - "~field112" - "~field113" - "~field114" - "~field115" - "~field116" - "~field117" - "~field118" - "~field119" - "~field120" - "~field121" - "~field122" - "~field123" - "~field124" - "~field125" - "~field126" - "~field127" - "~field128" - "~field129" - "~field130" - "~field131" - "~field132" - "~field133" - "~field134" - "~field135" - "~field136" - "~field137" - "~field138" - "~field139" - "~field140" - "~field141" - "~field142" - "~field143" - "~field144" - "~field145" - "~field146" - "~field147" - "~field148" - "~field149" - "~field150" - "~field151" - "~field152" - "~field153" - "~field154" - "~field155" - "~field156" - "~field157" - "~field158" - "~field159" - "~field160" - "~field161" - "~field162" - "~field163" - "~field164" - "~field165" - "~field166" - "~field167" - "~field168" - "~field169" - "~field170" - "~field171" - "~field172" - "~field173" - "~field174" - "~field175" - "~field176" - "~field177" - "~field178" - "~field179" - "~field180" - "~field181" - "~field182" - "~field183" - "~field184" - "~field185" - "~field186" - "~field187" - "~field188" - "~field189" - "~field190" - "~field191" - "~field192" - "~field193" - "~field194" - "~field195" - "~field196" - "~field197" - "~field198" - "~field199" - "~field200" - "~field201" - "~field202" - "~field203" - "~field204" - "~field205" - "~field206" - "~field207" - "~field208" - "~field209" - "~field210" - "~field211" - "~field212" - "~field213" - "~field214" - "~field215" - "~field216" - "~field217" - "~field218" - "~field219" - "~field220" - "~field221" - "~field222" - "~field223" - "~field224" - "~field225" - "~field226" - "~field227" - "~field228" - "~field229" - "~field230" - "~field231" - "~field232" - "~field233" - "~field234" - "~field235" - "~field236" - "~field237" - "~field238" - "~field239" - "~field240" - "~field241" - "~field242" - "~field243" - "~field244" - "~field245" - "~field246" - "~field247" - "~field248" - "~field249" - "~field250" - "~field251" - "~field252" - "~field253" - "~field254" - "~field255" - "~field256" - "~field257" - "~field258" - "~field259" - "~field260" - "~field261" - "~field262" - "~field263" - "~field264" - "~field265" - "~field266" - "~field267" - "~field268" - "~field269" - "~field270" - "~field271" - "~field272" - "~field273" - "~field274" - "~field275" - "~field276" - "~field277" - "~field278" - "~field279" - "~field280" - "~field281" - "~field282" - "~field283" - "~field284" - "~field285" - "~field286" - "~field287" - "~field288" - "~field289" - "~field290" - "~field291" - "~field292" - "~field293" - "~field294" - "~field295" - "~field296" - "~field297" - "~field298" - "~field299" - "~field300" - "~field301" - "~field302" - "~field303" - "~field304" - "~field305" - "~field306" - "~field307" - "~field308" - "~field309" - "~field310" - "~field311" - "~field312" - "~field313" - "~field314" - "~field315" - "~field316" - "~field317" - "~field318" - "~field319" - "~field320" - "~field321" - "~field322" - "~field323" - "~field324" - "~field325" - "~field326" - "~field327" - "~field328" - "~field329" - "~field330" - "~field331" - "~field332" - "~field333" - "~field334" - "~field335" - "~field336" - "~field337" - "~field338" - "~field339" - "~field340" - "~field341" - "~field342" - "~field343" - "~field344" - "~field345" - "~field346" - "~field347" - "~field348" - "~field349" - "~field350" - "~field351" - "~field352" - "~field353" - "~field354" - "~field355" - "~field356" - "~field357" - "~field358" - "~field359" - "~field360" - "~field361" - "~field362" - "~field363" - "~field364" - "~field365" - "~field366" - "~field367" - "~field368" - "~field369" - "~field370" - "~field371" - "~field372" - "~field373" - "~field374" - "~field375" - "~field376" - "~field377" - "~field378" - "~field379" - "~field380" - "~field381" - "~field382" - "~field383" - "~field384" - "~field385" - "~field386" - "~field387" - "~field388" - "~field389" - "~field390" - "~field391" - "~field392" - "~field393" - "~field394" - "~field395" - "~field396" - "~field397" - "~field398" - "~field399" - "~field400" - "~field401" - "~field402" - "~field403" - "~field404" - "~field405" - "~field406" - "~field407" - "~field408" - "~field409" - "~field410" - "~field411" - "~field412" - "~field413" - "~field414" - "~field415" - "~field416" - "~field417" - "~field418" - "~field419" - "~field420" - "~field421" - "~field422" - "~field423" - "~field424" - "~field425" - "~field426" - "~field427" - "~field428" - "~field429" - "~field430" - "~field431" - "~field432" - "~field433" - "~field434" - "~field435" - "~field436" - "~field437" - "~field438" - "~field439" - "~field440" - "~field441" - "~field442" - "~field443" - "~field444" - "~field445" - "~field446" - "~field447" - "~field448" - "~field449" - "~field450" - "~field451" - "~field452" - "~field453" - "~field454" - "~field455" - "~field456" - "~field457" - "~field458" - "~field459" - "~field460" - "~field461" - "~field462" - "~field463" - "~field464" - "~field465" - "~field466" - "~field467" - "~field468" - "~field469" - "~field470" - "~field471" - "~field472" - "~field473" - "~field474" - "~field475" - "~field476" - "~field477" - "~field478" - "~field479" - "~field480" - "~field481" - "~field482" - "~field483" - "~field484" - "~field485" - "~field486" - "~field487" - "~field488" - "~field489" - "~field490" - "~field491" - "~field492" - "~field493" - "~field494" - "~field495" - "~field496" - "~field497" - "~field498" - "~field499" - "~field500" - "~field501" - "~field502" - "~field503" - "~field504" - "~field505" - "~field506" - "~field507" - "~field508" - "~field509" - "~field510" - "~field511" - "~field512" - "~field513" - "~field514" - "~field515" - "~field516" - "~field517" - "~field518" - "~field519" - "~field520" - "~field521" - "~field522" - "~field523" - "~field524" - "~field525" - "~field526" - "~field527" - "~field528" - "~field529" - "~field530" - "~field531" - "~field532" - "~field533" - "~field534" - "~field535" - "~field536" - "~field537" - "~field538" - "~field539" - "~field540" - "~field541" - "~field542" - "~field543" - "~field544" - "~field545" - "~field546" - "~field547" - "~field548" - "~field549" - "~field550" - "~field551" - "~field552" - "~field553" - "~field554" - "~field555" - "~field556" - "~field557" - "~field558" - "~field559" - "~field560" - "~field561" - "~field562" - "~field563" - "~field564" - "~field565" - "~field566" - "~field567" - "~field568" - "~field569" - "~field570" - "~field571" - "~field572" - "~field573" - "~field574" - "~field575" - "~field576" - "~field577" - "~field578" - "~field579" - "~field580" - "~field581" - "~field582" - "~field583" - "~field584" - "~field585" - "~field586" - "~field587" - "~field588" - "~field589" - "~field590" - "~field591" - "~field592" - "~field593" - "~field594" - "~field595" - "~field596" - "~field597" - "~field598" - "~field599" - "~field600" - "~field601" - "~field602" - "~field603" - "~field604" - "~field605" - "~field606" - "~field607" - "~field608" - "~field609" - "~field610" - "~field611" - "~field612" - "~field613" - "~field614" - "~field615" - "~field616" - "~field617" - "~field618" - "~field619" - "~field620" - "~field621" - "~field622" - "~field623" - "~field624" - "~field625" - "~field626" - "~field627" - "~field628" - "~field629" - "~field630" - "~field631" - "~field632" - "~field633" - "~field634" - "~field635" - "~field636" - "~field637" - "~field638" - "~field639" - "~field640" - "~field641" - "~field642" - "~field643" - "~field644" - "~field645" - "~field646" - "~field647" - "~field648" - "~field649" - "~field650" - "~field651" - "~field652" - "~field653" - "~field654" - "~field655" - "~field656" - "~field657" - "~field658" - "~field659" - "~field660" - "~field661" - "~field662" - "~field663" - "~field664" - "~field665" - "~field666" - "~field667" - "~field668" - "~field669" - "~field670" - "~field671" - "~field672" - "~field673" - "~field674" - "~field675" - "~field676" - "~field677" - "~field678" - "~field679" - "~field680" - "~field681" - "~field682" - "~field683" - "~field684" - "~field685" - "~field686" - "~field687" - "~field688" - "~field689" - "~field690" - "~field691" - "~field692" - "~field693" - "~field694" - "~field695" - "~field696" - "~field697" - "~field698" - "~field699" - "~field700" - "~field701" - "~field702" - "~field703" - "~field704" - "~field705" - "~field706" - "~field707" - "~field708" - "~field709" - "~field710" - "~field711" - "~field712" - "~field713" - "~field714" - "~field715" - "~field716" - "~field717" - "~field718" - "~field719" - "~field720" - "~field721" - "~field722" - "~field723" - "~field724" - "~field725" - "~field726" - "~field727" - "~field728" - "~field729" - "~field730" - "~field731" - "~field732" - "~field733" - "~field734" - "~field735" - "~field736" - "~field737" - "~field738" - "~field739" - "~field740" - "~field741" - "~field742" - "~field743" - "~field744" - "~field745" - "~field746" - "~field747" - "~field748" - "~field749" - "~field750" - "~field751" - "~field752" - "~field753" - "~field754" - "~field755" - "~field756" - "~field757" - "~field758" - "~field759" - "~field760" - "~field761" - "~field762" - "~field763" - "~field764" - "~field765" - "~field766" - "~field767" - "~field768" - "~field769" - "~field770" - "~field771" - "~field772" - "~field773" - "~field774" - "~field775" - "~field776" - "~field777" - "~field778" - "~field779" - "~field780" - "~field781" - "~field782" - "~field783" - "~field784" - "~field785" - "~field786" - "~field787" - "~field788" - "~field789" - "~field790" - "~field791" - "~field792" - "~field793" - "~field794" - "~field795" - "~field796" - "~field797" - "~field798" - "~field799" - "~field800" - "~field801" - "~field802" - "~field803" - "~field804" - "~field805" - "~field806" - "~field807" - "~field808" - "~field809" - "~field810" - "~field811" - "~field812" - "~field813" - "~field814" - "~field815" - "~field816" - "~field817" - "~field818" - "~field819" - "~field820" - "~field821" - "~field822" - "~field823" - "~field824" - "~field825" - "~field826" - "~field827" - "~field828" - "~field829" - "~field830" - "~field831" - "~field832" - "~field833" - "~field834" - "~field835" - "~field836" - "~field837" - "~field838" - "~field839" - "~field840" - "~field841" - "~field842" - "~field843" - "~field844" - "~field845" - "~field846" - "~field847" - "~field848" - "~field849" - "~field850" - "~field851" - "~field852" - "~field853" - "~field854" - "~field855" - "~field856" - "~field857" - "~field858" - "~field859" - "~field860" - "~field861" - "~field862" - "~field863" - "~field864" - "~field865" - "~field866" - "~field867" - "~field868" - "~field869" - "~field870" - "~field871" - "~field872" - "~field873" - "~field874" - "~field875" - "~field876" - "~field877" - "~field878" - "~field879" - "~field880" - "~field881" - "~field882" - "~field883" - "~field884" - "~field885" - "~field886" - "~field887" - "~field888" - "~field889" - "~field890" - "~field891" - "~field892" - "~field893" - "~field894" - "~field895" - "~field896" - "~field897" - "~field898" - "~field899" - "~field900" - "~field901" - "~field902" - "~field903" - "~field904" - "~field905" - "~field906" - "~field907" - "~field908" - "~field909" - "~field910" - "~field911" - "~field912" - "~field913" - "~field914" - "~field915" - "~field916" - "~field917" - "~field918" - "~field919" - "~field920" - "~field921" - "~field922" - "~field923" - "~field924" - "~field925" - "~field926" - "~field927" - "~field928" - "~field929" - "~field930" - "~field931" - "~field932" - "~field933" - "~field934" - "~field935" - "~field936" - "~field937" - "~field938" - "~field939" - "~field940" - "~field941" - "~field942" - "~field943" - "~field944" - "~field945" - "~field946" - "~field947" - "~field948" - "~field949" - "~field950" - "~field951" - "~field952" - "~field953" - "~field954" - "~field955" - "~field956" - "~field957" - "~field958" - "~field959" - "~field960" - "~field961" - "~field962" - "~field963" - "~field964" - "~field965" - "~field966" - "~field967" - "~field968" - "~field969" - "~field970" - "~field971" - "~field972" - "~field973" - "~field974" - "~field975" - "~field976" - "~field977" - "~field978" - "~field979" - "~field980" - "~field981" - "~field982" - "~field983" - "~field984" - "~field985" - "~field986" - "~field987" - "~field988" - "~field989" - "~field990" - "~field991" - "~field992" - "~field993" - "~field994" - "~field995" - "~field996" - "~field997" - "~field998" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_deals_without_amount_reversed_fields: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: null fls: - "~customer.*" - "~zip" masked_fields: null allowed_actions: - "*" - index_patterns: - "finance" dls: null fls: - "~finfield1" - "~finfield2" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_regex: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: [] index_permissions: - index_patterns: - "/\\S*ogstash-\\S*/" dls: "{\"term\" : {\"msgid\" : \"12\"}}" fls: - "msgid" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_midsized_deals: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: "{\n \"range\" : {\n \"amount\" : {\n \"gte\" : 1000,\n \ \ \"lte\" : 20000\n }\n }\n}\n \n" fls: null masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" tenant_permissions: [] opendistro_security_dls_multi1: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: "{\n \"range\" : {\n \"amount\" : {\n \"gte\" : 1000,\n \ \ \"lte\" : 20000\n }\n }\n}\n" fls: - "customer.*" - "amount" masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" tenant_permissions: [] opendistro_security_masked_nowc: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "OPENDISTRO_SECURITY_CLUSTER_COMPOSITE_OPS" index_permissions: - index_patterns: - "logs" dls: null fls: null masked_fields: - "clientip::/[0-9]{1,3}/::*" - "ip::/[0-9]{1,3}/::XXX" - "phpmemory::/[0-9]{1,}/::XXX" - "agent::/Mozilla|AppleWebKit|Chrome|MSIE|FIREFOX/::ANONYMIZED_BROWSER" - "url::/elastic/::static" - "machine.os::SHA-512" - "message::SHA-512" - "referer::MD5" - "request::SHA-1" - "tags" - "timestamp" allowed_actions: - "*" tenant_permissions: [] opendistro_security_deals_without_amount: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: null fls: - "customer.*" - "zip" masked_fields: null allowed_actions: - "*" - index_patterns: - "finance" dls: null fls: - "finfield1" - "finfield2" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_masked_nowc1: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "OPENDISTRO_SECURITY_CLUSTER_COMPOSITE_OPS" index_permissions: - index_patterns: - "logs" dls: null fls: null masked_fields: - "clientip::/.*/::a" - "ip::/.*/::a" - "phpmemory::/.*/::a" - "agent::/.*/::a" - "url::/.*/::a" - "machine.os::/./::a" - "message::/.*/::a" - "referer::/.*/::a" - "request::/.*/::a" - "tags::/./::a" - "timestamp::/.*/::a" allowed_actions: - "*" tenant_permissions: [] opendistro_security_all_access: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "*" dls: null fls: null masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_prop_replace: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "prop1" dls: "{\"term\" : {\"${user.name}\" : \"yes\"}}" fls: null masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" - index_patterns: - "prop2" dls: "{\"terms\" : { \"role\" : [${user.roles}]}}" fls: null masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" - index_patterns: - "prop-mapped" dls: "{\"terms\" : { \"securityRole\" : [${user.securityRoles}]}}" fls: null masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" tenant_permissions: [] opendistro_security_logstash: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: [] index_permissions: - index_patterns: - "logstash-*" dls: "{\"term\" : {\"msgid\" : \"12\"}}" fls: - "msgid" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_perf_wc_ex: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: null fls: - "~field5*" - "~field9*" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_masked_custom: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "*" dls: null fls: null masked_fields: - "*ip_dest::/[0-9]{1,3}$/::XXX" - "*ip_source::/[0-9]{1,3}$/::XXX::/^[0-9]{1,3}/::***" - "customer.name::SHA-512" - "mynum::/[0-9]{1,}$/::XXX" allowed_actions: - "indices:data/read/*" tenant_permissions: [] opendistro_security_perf_named_only: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: null fls: - "field3" - "field4" - "field5" - "field6" - "field7" - "field8" - "field9" - "field10" - "field11" - "field12" - "field13" - "field14" - "field15" - "field16" - "field17" - "field18" - "field19" - "field20" - "field21" - "field22" - "field23" - "field24" - "field25" - "field26" - "field27" - "field28" - "field29" - "field30" - "field31" - "field32" - "field33" - "field34" - "field35" - "field36" - "field37" - "field38" - "field39" - "field40" - "field41" - "field42" - "field43" - "field44" - "field45" - "field46" - "field47" - "field48" - "field49" - "field50" - "field51" - "field52" - "field53" - "field54" - "field55" - "field56" - "field57" - "field58" - "field59" - "field60" - "field61" - "field62" - "field63" - "field64" - "field65" - "field66" - "field67" - "field68" - "field69" - "field70" - "field71" - "field72" - "field73" - "field74" - "field75" - "field76" - "field77" - "field78" - "field79" - "field80" - "field81" - "field82" - "field83" - "field84" - "field85" - "field86" - "field87" - "field88" - "field89" - "field90" - "field91" - "field92" - "field93" - "field94" - "field95" - "field96" - "field97" - "field98" - "field99" - "field100" - "field101" - "field102" - "field103" - "field104" - "field105" - "field106" - "field107" - "field108" - "field109" - "field110" - "field111" - "field112" - "field113" - "field114" - "field115" - "field116" - "field117" - "field118" - "field119" - "field120" - "field121" - "field122" - "field123" - "field124" - "field125" - "field126" - "field127" - "field128" - "field129" - "field130" - "field131" - "field132" - "field133" - "field134" - "field135" - "field136" - "field137" - "field138" - "field139" - "field140" - "field141" - "field142" - "field143" - "field144" - "field145" - "field146" - "field147" - "field148" - "field149" - "field150" - "field151" - "field152" - "field153" - "field154" - "field155" - "field156" - "field157" - "field158" - "field159" - "field160" - "field161" - "field162" - "field163" - "field164" - "field165" - "field166" - "field167" - "field168" - "field169" - "field170" - "field171" - "field172" - "field173" - "field174" - "field175" - "field176" - "field177" - "field178" - "field179" - "field180" - "field181" - "field182" - "field183" - "field184" - "field185" - "field186" - "field187" - "field188" - "field189" - "field190" - "field191" - "field192" - "field193" - "field194" - "field195" - "field196" - "field197" - "field198" - "field199" - "field200" - "field201" - "field202" - "field203" - "field204" - "field205" - "field206" - "field207" - "field208" - "field209" - "field210" - "field211" - "field212" - "field213" - "field214" - "field215" - "field216" - "field217" - "field218" - "field219" - "field220" - "field221" - "field222" - "field223" - "field224" - "field225" - "field226" - "field227" - "field228" - "field229" - "field230" - "field231" - "field232" - "field233" - "field234" - "field235" - "field236" - "field237" - "field238" - "field239" - "field240" - "field241" - "field242" - "field243" - "field244" - "field245" - "field246" - "field247" - "field248" - "field249" - "field250" - "field251" - "field252" - "field253" - "field254" - "field255" - "field256" - "field257" - "field258" - "field259" - "field260" - "field261" - "field262" - "field263" - "field264" - "field265" - "field266" - "field267" - "field268" - "field269" - "field270" - "field271" - "field272" - "field273" - "field274" - "field275" - "field276" - "field277" - "field278" - "field279" - "field280" - "field281" - "field282" - "field283" - "field284" - "field285" - "field286" - "field287" - "field288" - "field289" - "field290" - "field291" - "field292" - "field293" - "field294" - "field295" - "field296" - "field297" - "field298" - "field299" - "field300" - "field301" - "field302" - "field303" - "field304" - "field305" - "field306" - "field307" - "field308" - "field309" - "field310" - "field311" - "field312" - "field313" - "field314" - "field315" - "field316" - "field317" - "field318" - "field319" - "field320" - "field321" - "field322" - "field323" - "field324" - "field325" - "field326" - "field327" - "field328" - "field329" - "field330" - "field331" - "field332" - "field333" - "field334" - "field335" - "field336" - "field337" - "field338" - "field339" - "field340" - "field341" - "field342" - "field343" - "field344" - "field345" - "field346" - "field347" - "field348" - "field349" - "field350" - "field351" - "field352" - "field353" - "field354" - "field355" - "field356" - "field357" - "field358" - "field359" - "field360" - "field361" - "field362" - "field363" - "field364" - "field365" - "field366" - "field367" - "field368" - "field369" - "field370" - "field371" - "field372" - "field373" - "field374" - "field375" - "field376" - "field377" - "field378" - "field379" - "field380" - "field381" - "field382" - "field383" - "field384" - "field385" - "field386" - "field387" - "field388" - "field389" - "field390" - "field391" - "field392" - "field393" - "field394" - "field395" - "field396" - "field397" - "field398" - "field399" - "field400" - "field401" - "field402" - "field403" - "field404" - "field405" - "field406" - "field407" - "field408" - "field409" - "field410" - "field411" - "field412" - "field413" - "field414" - "field415" - "field416" - "field417" - "field418" - "field419" - "field420" - "field421" - "field422" - "field423" - "field424" - "field425" - "field426" - "field427" - "field428" - "field429" - "field430" - "field431" - "field432" - "field433" - "field434" - "field435" - "field436" - "field437" - "field438" - "field439" - "field440" - "field441" - "field442" - "field443" - "field444" - "field445" - "field446" - "field447" - "field448" - "field449" - "field450" - "field451" - "field452" - "field453" - "field454" - "field455" - "field456" - "field457" - "field458" - "field459" - "field460" - "field461" - "field462" - "field463" - "field464" - "field465" - "field466" - "field467" - "field468" - "field469" - "field470" - "field471" - "field472" - "field473" - "field474" - "field475" - "field476" - "field477" - "field478" - "field479" - "field480" - "field481" - "field482" - "field483" - "field484" - "field485" - "field486" - "field487" - "field488" - "field489" - "field490" - "field491" - "field492" - "field493" - "field494" - "field495" - "field496" - "field497" - "field498" - "field499" - "field500" - "field501" - "field502" - "field503" - "field504" - "field505" - "field506" - "field507" - "field508" - "field509" - "field510" - "field511" - "field512" - "field513" - "field514" - "field515" - "field516" - "field517" - "field518" - "field519" - "field520" - "field521" - "field522" - "field523" - "field524" - "field525" - "field526" - "field527" - "field528" - "field529" - "field530" - "field531" - "field532" - "field533" - "field534" - "field535" - "field536" - "field537" - "field538" - "field539" - "field540" - "field541" - "field542" - "field543" - "field544" - "field545" - "field546" - "field547" - "field548" - "field549" - "field550" - "field551" - "field552" - "field553" - "field554" - "field555" - "field556" - "field557" - "field558" - "field559" - "field560" - "field561" - "field562" - "field563" - "field564" - "field565" - "field566" - "field567" - "field568" - "field569" - "field570" - "field571" - "field572" - "field573" - "field574" - "field575" - "field576" - "field577" - "field578" - "field579" - "field580" - "field581" - "field582" - "field583" - "field584" - "field585" - "field586" - "field587" - "field588" - "field589" - "field590" - "field591" - "field592" - "field593" - "field594" - "field595" - "field596" - "field597" - "field598" - "field599" - "field600" - "field601" - "field602" - "field603" - "field604" - "field605" - "field606" - "field607" - "field608" - "field609" - "field610" - "field611" - "field612" - "field613" - "field614" - "field615" - "field616" - "field617" - "field618" - "field619" - "field620" - "field621" - "field622" - "field623" - "field624" - "field625" - "field626" - "field627" - "field628" - "field629" - "field630" - "field631" - "field632" - "field633" - "field634" - "field635" - "field636" - "field637" - "field638" - "field639" - "field640" - "field641" - "field642" - "field643" - "field644" - "field645" - "field646" - "field647" - "field648" - "field649" - "field650" - "field651" - "field652" - "field653" - "field654" - "field655" - "field656" - "field657" - "field658" - "field659" - "field660" - "field661" - "field662" - "field663" - "field664" - "field665" - "field666" - "field667" - "field668" - "field669" - "field670" - "field671" - "field672" - "field673" - "field674" - "field675" - "field676" - "field677" - "field678" - "field679" - "field680" - "field681" - "field682" - "field683" - "field684" - "field685" - "field686" - "field687" - "field688" - "field689" - "field690" - "field691" - "field692" - "field693" - "field694" - "field695" - "field696" - "field697" - "field698" - "field699" - "field700" - "field701" - "field702" - "field703" - "field704" - "field705" - "field706" - "field707" - "field708" - "field709" - "field710" - "field711" - "field712" - "field713" - "field714" - "field715" - "field716" - "field717" - "field718" - "field719" - "field720" - "field721" - "field722" - "field723" - "field724" - "field725" - "field726" - "field727" - "field728" - "field729" - "field730" - "field731" - "field732" - "field733" - "field734" - "field735" - "field736" - "field737" - "field738" - "field739" - "field740" - "field741" - "field742" - "field743" - "field744" - "field745" - "field746" - "field747" - "field748" - "field749" - "field750" - "field751" - "field752" - "field753" - "field754" - "field755" - "field756" - "field757" - "field758" - "field759" - "field760" - "field761" - "field762" - "field763" - "field764" - "field765" - "field766" - "field767" - "field768" - "field769" - "field770" - "field771" - "field772" - "field773" - "field774" - "field775" - "field776" - "field777" - "field778" - "field779" - "field780" - "field781" - "field782" - "field783" - "field784" - "field785" - "field786" - "field787" - "field788" - "field789" - "field790" - "field791" - "field792" - "field793" - "field794" - "field795" - "field796" - "field797" - "field798" - "field799" - "field800" - "field801" - "field802" - "field803" - "field804" - "field805" - "field806" - "field807" - "field808" - "field809" - "field810" - "field811" - "field812" - "field813" - "field814" - "field815" - "field816" - "field817" - "field818" - "field819" - "field820" - "field821" - "field822" - "field823" - "field824" - "field825" - "field826" - "field827" - "field828" - "field829" - "field830" - "field831" - "field832" - "field833" - "field834" - "field835" - "field836" - "field837" - "field838" - "field839" - "field840" - "field841" - "field842" - "field843" - "field844" - "field845" - "field846" - "field847" - "field848" - "field849" - "field850" - "field851" - "field852" - "field853" - "field854" - "field855" - "field856" - "field857" - "field858" - "field859" - "field860" - "field861" - "field862" - "field863" - "field864" - "field865" - "field866" - "field867" - "field868" - "field869" - "field870" - "field871" - "field872" - "field873" - "field874" - "field875" - "field876" - "field877" - "field878" - "field879" - "field880" - "field881" - "field882" - "field883" - "field884" - "field885" - "field886" - "field887" - "field888" - "field889" - "field890" - "field891" - "field892" - "field893" - "field894" - "field895" - "field896" - "field897" - "field898" - "field899" - "field900" - "field901" - "field902" - "field903" - "field904" - "field905" - "field906" - "field907" - "field908" - "field909" - "field910" - "field911" - "field912" - "field913" - "field914" - "field915" - "field916" - "field917" - "field918" - "field919" - "field920" - "field921" - "field922" - "field923" - "field924" - "field925" - "field926" - "field927" - "field928" - "field929" - "field930" - "field931" - "field932" - "field933" - "field934" - "field935" - "field936" - "field937" - "field938" - "field939" - "field940" - "field941" - "field942" - "field943" - "field944" - "field945" - "field946" - "field947" - "field948" - "field949" - "field950" - "field951" - "field952" - "field953" - "field954" - "field955" - "field956" - "field957" - "field958" - "field959" - "field960" - "field961" - "field962" - "field963" - "field964" - "field965" - "field966" - "field967" - "field968" - "field969" - "field970" - "field971" - "field972" - "field973" - "field974" - "field975" - "field976" - "field977" - "field978" - "field979" - "field980" - "field981" - "field982" - "field983" - "field984" - "field985" - "field986" - "field987" - "field988" - "field989" - "field990" - "field991" - "field992" - "field993" - "field994" - "field995" - "field996" - "field997" - "field998" masked_fields: null allowed_actions: - "*" tenant_permissions: [] opendistro_security_combined: reserved: false hidden: false description: "Migrated from v6 (all types mapped)" cluster_permissions: - "*" index_permissions: - index_patterns: - "deals" dls: "{\n \"range\" : {\n \"amount\" : {\n \"gte\" : 1000,\n \ \ \"lte\" : 20000\n }\n }\n}\n" fls: - "customer.*" - "amount" masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ" tenant_permissions: [] logs_index_with_dls: index_permissions: - index_patterns: - "logs" dls: "{\"bool\": {\"filter\": {\"term\" : {\"termX\" : \"A\" }}}}" masked_fields: null allowed_actions: - "OPENDISTRO_SECURITY_READ"