NLS User access to specific index

[animumrege]

Is there a way in NLS to only allow users to view a specific index or indexes? For example, we can create multiple indexes based on departments using output as follows:

output {
elasticsearch {
host => localhost
cluster => "elasticsearch_prod"
index => "dept_a"
}
}

We would like to restrict users to view access to their departmental indexes.

Thanks

[mcapra]

Nope. NLS uses the default naming conventions for a Logstash+Elasticsearch setup of the current version (logstash-yyyy.mm.dd). Though custom indices is an idea that has been tossed around a bit (which would open the door for what you're seeking) it's not something we've officially implemented.