Hi,
I have configured jwt token auth for kibana and ES.
I have an index with document level security as follows:
{
“bool”: {
“must”: {
“match”: {
“Carrier”: “${attr.jwt.air}”
}
}
}
}
when I search the index from the discover page, results do get filtered according to the jwt claims, but when I try to configure a monitor on the index, it returns empty results.
when I change the document level security policy to a ‘static’ filter - I do get results back according to the filter :
{
“bool”: {
“must”: {
“match”: {
“Carrier”: “static_value”
}
}
}
}
so it seems that the jwt claims does not propagate to the monitor
anybody encountered this ?
thanks