From 9f42195bf0d6cd2ee1f7edbf10d5328664539576 Mon Sep 17 00:00:00 2001 From: David Zane Date: Fri, 24 Jul 2026 09:20:56 -1000 Subject: [PATCH 1/5] Document wildcard prefix matching for principal username and role WLM rules Signed-off-by: David Zane --- .../workload-management/workload-group-rules.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md index 4bd8bea78eb..8635b015545 100644 --- a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md +++ b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md @@ -52,8 +52,8 @@ The table lists the attributes in order of priority, from highest to lowest. Thi | Attribute | Data type | Description | |:---------------------|:----------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `principal.username` | List | A list of usernames to be matched to this rule. This attribute is available only when the Security plugin is enabled on the domain. The attribute supports exact matching only. | -| `principal.role` | List | A list of roles to be matched to this rule. This attribute is available only when the Security plugin is enabled on the domain. The attribute supports exact matching only. | +| `principal.username` | List | A list of usernames to be matched to this rule. This attribute is available only when the Security plugin is enabled on the domain. An element that is a full username (for example, `admin`) is matched exactly; an element ending in `*` (for example, `admin*`) is matched as a prefix. | +| `principal.role` | List | A list of roles to be matched to this rule. This attribute is available only when the Security plugin is enabled on the domain. An element that is a full role name (for example, `all_access`) is matched exactly; an element ending in `*` (for example, `all_*`) is matched as a prefix. | | `index_pattern` | List | A list of target indexes for incoming queries. An element that is a full index name (for example, `logs-2025`) is matched exactly; an element ending in `*` (for example, `logs*`) is matched as a prefix. | ## Parameters From b3c91f59a133f6c4a649ad3aadc718f8f50905a2 Mon Sep 17 00:00:00 2001 From: David Zane Date: Fri, 24 Jul 2026 11:49:40 -1000 Subject: [PATCH 2/5] Simplify wildcard matching wording for principal attributes Signed-off-by: David Zane --- .../workload-management/workload-group-rules.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md index 8635b015545..0d299670cef 100644 --- a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md +++ b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md @@ -52,8 +52,8 @@ The table lists the attributes in order of priority, from highest to lowest. Thi | Attribute | Data type | Description | |:---------------------|:----------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `principal.username` | List | A list of usernames to be matched to this rule. This attribute is available only when the Security plugin is enabled on the domain. An element that is a full username (for example, `admin`) is matched exactly; an element ending in `*` (for example, `admin*`) is matched as a prefix. | -| `principal.role` | List | A list of roles to be matched to this rule. This attribute is available only when the Security plugin is enabled on the domain. An element that is a full role name (for example, `all_access`) is matched exactly; an element ending in `*` (for example, `all_*`) is matched as a prefix. | +| `principal.username` | List | A list of usernames to be matched to this rule. Add `*` to the end of a value to match every username that starts with it, or omit it to match a username exactly. This attribute is available only when the Security plugin is enabled on the domain. | +| `principal.role` | List | A list of roles to be matched to this rule. Add `*` to the end of a value to match every role that starts with it, or omit it to match a role exactly. This attribute is available only when the Security plugin is enabled on the domain. | | `index_pattern` | List | A list of target indexes for incoming queries. An element that is a full index name (for example, `logs-2025`) is matched exactly; an element ending in `*` (for example, `logs*`) is matched as a prefix. | ## Parameters From 043f8288321d6443900aad23b64236a839277948 Mon Sep 17 00:00:00 2001 From: David Zane Date: Fri, 24 Jul 2026 11:51:20 -1000 Subject: [PATCH 3/5] Tighten wildcard matching wording for principal attributes Signed-off-by: David Zane --- .../workload-management/workload-group-rules.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md index 0d299670cef..ae55aa43e38 100644 --- a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md +++ b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md @@ -52,8 +52,8 @@ The table lists the attributes in order of priority, from highest to lowest. Thi | Attribute | Data type | Description | |:---------------------|:----------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `principal.username` | List | A list of usernames to be matched to this rule. Add `*` to the end of a value to match every username that starts with it, or omit it to match a username exactly. This attribute is available only when the Security plugin is enabled on the domain. | -| `principal.role` | List | A list of roles to be matched to this rule. Add `*` to the end of a value to match every role that starts with it, or omit it to match a role exactly. This attribute is available only when the Security plugin is enabled on the domain. | +| `principal.username` | List | A list of usernames to be matched to this rule. Supports exact match (`user1`) and trailing wildcard patterns (`user*`). This attribute is available only when the Security plugin is enabled on the domain. | +| `principal.role` | List | A list of roles to be matched to this rule. Supports exact match (`role1`) and trailing wildcard patterns (`role*`). This attribute is available only when the Security plugin is enabled on the domain. | | `index_pattern` | List | A list of target indexes for incoming queries. An element that is a full index name (for example, `logs-2025`) is matched exactly; an element ending in `*` (for example, `logs*`) is matched as a prefix. | ## Parameters From a469c60f67daa739f71c2e013e704d86f9cf70d5 Mon Sep 17 00:00:00 2001 From: David Zane Date: Fri, 24 Jul 2026 11:51:39 -1000 Subject: [PATCH 4/5] Align index_pattern matching wording with principal attributes Signed-off-by: David Zane --- .../workload-management/workload-group-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md index ae55aa43e38..6d912bd4719 100644 --- a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md +++ b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md @@ -54,7 +54,7 @@ The table lists the attributes in order of priority, from highest to lowest. Thi |:---------------------|:----------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `principal.username` | List | A list of usernames to be matched to this rule. Supports exact match (`user1`) and trailing wildcard patterns (`user*`). This attribute is available only when the Security plugin is enabled on the domain. | | `principal.role` | List | A list of roles to be matched to this rule. Supports exact match (`role1`) and trailing wildcard patterns (`role*`). This attribute is available only when the Security plugin is enabled on the domain. | -| `index_pattern` | List | A list of target indexes for incoming queries. An element that is a full index name (for example, `logs-2025`) is matched exactly; an element ending in `*` (for example, `logs*`) is matched as a prefix. | +| `index_pattern` | List | A list of target indexes for incoming queries. Supports exact match (`logs-2025`) and trailing wildcard patterns (`logs*`). | ## Parameters From d1c77e1a61e002e0003155738137c4f677c8e206 Mon Sep 17 00:00:00 2001 From: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Date: Tue, 28 Jul 2026 10:51:36 -0400 Subject: [PATCH 5/5] Apply suggestions from code review Co-authored-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> Signed-off-by: kolchfa-aws <105444904+kolchfa-aws@users.noreply.github.com> --- .../workload-management/workload-group-rules.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md index 6d912bd4719..62f0d271fe1 100644 --- a/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md +++ b/_tuning-your-cluster/availability-and-recovery/workload-management/workload-group-rules.md @@ -52,9 +52,9 @@ The table lists the attributes in order of priority, from highest to lowest. Thi | Attribute | Data type | Description | |:---------------------|:----------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `principal.username` | List | A list of usernames to be matched to this rule. Supports exact match (`user1`) and trailing wildcard patterns (`user*`). This attribute is available only when the Security plugin is enabled on the domain. | -| `principal.role` | List | A list of roles to be matched to this rule. Supports exact match (`role1`) and trailing wildcard patterns (`role*`). This attribute is available only when the Security plugin is enabled on the domain. | -| `index_pattern` | List | A list of target indexes for incoming queries. Supports exact match (`logs-2025`) and trailing wildcard patterns (`logs*`). | +| `principal.username` | List | A list of usernames to be matched to this rule. Supports exact match (for example, `user1`) and trailing wildcard patterns (for example, `user*`). This attribute is available only when the Security plugin is enabled on the domain. | +| `principal.role` | List | A list of roles to be matched to this rule. Supports exact match (for example, `role1`) and trailing wildcard patterns (for example, `role*`). This attribute is available only when the Security plugin is enabled on the domain. | +| `index_pattern` | List | A list of target indexes for incoming queries. Supports exact match (for example, `logs-2025`) and trailing wildcard patterns (for example, `logs*`). | ## Parameters