{
    "description": "access to the defined indices filtered by subscription_id via read_cross_cluster from remote",

    "elasticsearch": {
        "indices": [
            {
                "names": [
                {% for index in indices %}
                    "{{ index }}"{% if not loop.last %},{% endif %}
                {% endfor %}
                ],
                "privileges": [
                    "read",
                    "read_cross_cluster",
                    "view_index_metadata"
                ],
                "query": "{\"terms\": {\"azure.subscription_id\": [ {% for subscription_id in subscription_ids %}\"{{ subscription_id }}\"{% if not loop.last %},{% endif %}{% endfor %} ]}}"
            }

        ]
    }
}
