Migration tool for users and roles

The easiest way to migrate from file based users and roles to the native realm is to use the migrate tool included with the shield plugin. The migrate tool reads the file realm files to load the defined users and realms and executes HTTP requests to add the specified user(s) and role(s) to the store.

To run the migrate tool after installing the shield plugin, run the migrate tool as follows:

$ bin/shield/migrate native -U http://localhost:9200 -u test_user -p changeme -n lee,foo -r role1,role2,role3,role4,foo
starting migration of users and roles...
importing users from [/home/es/config/shield/users]...
found existing users: [test_user, joe3, joe2]
migrating user [lee]
no user [foo] found, skipping
importing roles from [/home/es/config/shield/roles.yml]...
found existing roles: [marvel_user, role_query_fields, admin_role, role3, admin, remote_marvel_agent, power_user, role_new_format_name_array, role_run_as, logstash, role_fields, role_run_as1, role_new_format, kibana4_server, user, transport_client, role1.ab, role_query]
migrating role [role1]
migrating role [role2]
role [role3] already exists, skipping
no role [foo] found, skipping
users and roles imported.

Existing users or roles will not be replaced or overridden, and users or roles will be skipped if they do not occur in the file based configuration.

The "native" subcommand supports the following options:

Table 7. Migration Tool Settings




-U, --url


The URL endpoint of the Elasticsearch cluster to which the users and roles will be added

-u, --username


Username to use for authentication

-p, --password


Password to use for authentication

-c, --config


Configuration directory to use instead of the default for SSL configuration, user, and role files

-n, --users


Comma-separated list of usernames to migrate, if empty, all users found will be migrated

-r, --roles


Comma-separated list of role names to migrate, if empty, all roles found will be migrated