Nginx configuration for Kibana-ElasticSearch read-only/read-write access

nginx-kibana.conf

upstream elasticsearch_upstream {
  server 10.10.10.10:9200;
  keepalive 15;
}

upstream kibana_upstream {
  server 127.0.0.1:5601;
}

# Kibana, public access, RO operations
server {
  listen 80 default_server;
  server_name _;

  error_log   /var/log/nginx/kibana-errors.log;
  access_log  /var/log/nginx/kibana.log;

  location / {
    proxy_pass http://kibana_upstream;
    proxy_redirect off;
    proxy_http_version 1.1;
    add_header Access-Control-Allow-Origin *;
    proxy_set_header X-Real-IP  $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header Connection "Keep-Alive";
    proxy_set_header Proxy-Connection "Keep-Alive";
  }
}

# Elasticsearch, public access, RO operations
server {
  listen 9200 default_server;
  server_name _;

  error_log   /var/log/nginx/elasticsearch-errors.log;
  access_log  /var/log/nginx/elasticsearch.log;

  # Read only access to Kibana
  # deny other than get/post/options/head
  # allow post when used with _search/_msearch/_mget
  # allow get/options/head
  set $posting 11;
  set $deleting 11;
  set $putting 11;
  if ( $request_method !~ ^(GET|POST|OPTIONS|HEAD|DELETE|PUT)$ )                    { return 405; }
  if ( $request_method = POST )                                                     { set $posting 1; }
  if ( $request_uri ~ ^/(.+/)*(_search|_mget|_msearch|_field_stats)(.*)$ )          { set $posting "${posting}1"; }
  if ( $request_method = DELETE )                                                   { set $deleting 1; }
  if ( $request_uri ~ ^/(.+/)*(_pit)(.*)$ )                                         { set $deleting 11; set $posting 11; set $putting 11; }
  if ( $request_method = PUT )                                                      { set $putting 1; }
  if ( $request_uri ~ ^/\.kibana(.*)$ )                                             { set $putting 11; set $posting 11; set $deleting 11; }
  if ( $posting != 11 )                                                             { return 403; }
  if ( $deleting != 11 )                                                            { return 403; }
  if ( $putting != 11 )                                                             { return 403; }

  location / {
    proxy_pass http://elasticsearch_upstream;
    proxy_redirect off;
    proxy_http_version 1.1;
    add_header Access-Control-Allow-Origin *;
    proxy_set_header X-Real-IP  $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header Connection "Keep-Alive";
    proxy_set_header Proxy-Connection "Keep-Alive";
  }
}