# Index patterns and index permissions

**URL:** <https://forum.opensearch.org/t/index-patterns-and-index-permissions/9369>\
**Category:** Security\
**Tags:** configure\
**Created:** [April 24, 2022, 3:42pm UTC](https://forum.opensearch.org/t/index-patterns-and-index-permissions/9369 "2022-04-24T15:42:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![liamh](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@liamh](https://forum.opensearch.org/u/liamh)\
**Post date:** [April 24, 2022, 3:42pm UTC](https://forum.opensearch.org/t/index-patterns-and-index-permissions/9369/1 "2022-04-24T15:42:32Z")

</div>

Hi

I have several indexes named like: events\_100,events\_200,events\_300 (the number represents a customer).  
I have users who should only see (for example) events\_200 so I set the index permissions in the role to be events\_200\* (works as expected).  
But as soon as I try to view the data, the index pattern events\_\* shows me nothing and I got 403 errors. If I create a new index pattern specifically for events\_200\* then it works fine.

Is there any way to set up a common set of visualisations all based off the less-specific index pattern events\_\*? When I try, I see that index pattern events\_\* catches all the index and OS reports that I don’t have permissions on the other indexes caught by the pattern then returns an error rather than the data for the index on which I do have read access.

I can work around this by rebuilding the visualisations/dashboard against an index pattern specific to that customer but this is a bit difficult to scale/automate (I will have to unpack the saved object ndjson and change the src pattern I guess). Same problem for if I want a user to be able to see the data for multiple customers.

Is there something I’m missing or is this the way it’s supposed to work?

Really big thanks in advance!

---

<div class="post-metadata">

**Author:** ![liamh](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@liamh](https://forum.opensearch.org/u/liamh)\
**Post date:** [April 25, 2022, 8:28pm UTC](https://forum.opensearch.org/t/index-patterns-and-index-permissions/9369/2 "2022-04-25T20:28:43Z")

</div>

I think I got it, setting `do_not_fail_on_forbidden: true` in the Opensearch config makes it ignore indexes it cannot access.