stack es security put-role cli command

elastic stack es security put-role --name <name> [options]

Create or update roles.

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--name string required

The name of the role that is being created or updated. On Elasticsearch Serverless, the role name must begin with a letter or digit and can only contain letters, digits and the characters '_', '-', and '.'. Each role must have a unique name, as this will serve as the identifier for that role.

--refresh enum

If true (the default) then refresh the affected shards to make this operation visible to search, if wait_for then wait for a refresh to make this operation visible to search, if false then do nothing with refreshes.

Values: true, false, wait_for

--applications string[]

A list of application privilege entries.

Repeatable: pass --applications multiple times to supply more than one value

--cluster string[]

A list of cluster privileges. These privileges define the cluster-level actions for users with this role.

Repeatable: pass --cluster multiple times to supply more than one value

--global string

An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware. Support for global privileges is currently limited to the management of application privileges.

--indices string[]

A list of indices permissions entries.

Repeatable: pass --indices multiple times to supply more than one value

--remote-indices string[]

A list of remote indices permissions entries. NOTE: Remote indices are effective for remote clusters configured with the API key based model. They have no effect for remote clusters configured with the certificate based model.

Repeatable: pass --remote-indices multiple times to supply more than one value

--remote-cluster string[]

A list of remote cluster permissions entries.

Repeatable: pass --remote-cluster multiple times to supply more than one value

--metadata string

Optional metadata. Within the metadata object, keys that begin with an underscore (_) are reserved for system use.

--run-as string[]

A list of users that the owners of this role can impersonate. Note: in Serverless, the run-as feature is disabled. For API compatibility, you can still specify an empty run_as field, but a non-empty list will be rejected.

Repeatable: pass --run-as multiple times to supply more than one value

--description string

Optional description of the role descriptor

--transient-metadata string

Indicates roles that might be incompatible with the current cluster license, specifically roles with document and field level security. When the cluster license doesn’t allow certain features for a given role, this parameter is updated dynamically to list the incompatible features. If enabled is false, the role is ignored, but is still listed in the response from the authenticate API.

--error-trace

When set to true Elasticsearch will include the full stack trace of errors when they occur.

--filter-path string

Comma-separated list of filters in dot notation which reduce the response returned by Elasticsearch.

Repeatable: pass --filter-path multiple times to supply more than one value

--human

When set to true will return statistics in a format suitable for humans. For example "exists_time": "1h" for humans and "exists_time_in_millis": 3600000 for computers. When disabled the human readable values will be omitted. This makes sense for responses being consumed only by machines.

--pretty

If set to true the returned JSON will be "pretty-formatted". Only use this option for debugging only.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON