unable to create custom role with document filters

[Susfubar]

I have followed the instructions for RBAC (https://docs.securityonion.net/en/2.3/rbac.html?highlight=custom_roles#creating-custom-roles). I run into an issue where the role does not create in kibana without removing the "query" part. Once I do remove the query, the role is created and the user can login to kibana. I am trying to create a query that will be an exact observer.name. Below is the indices portion that I am using. I have also done exact copy of the example query that does prefix. As well as other iterations.

"indices": [
{
"names": [
"so-*"
],
"privileges": [
"index",
"maintenance",
"monitor",
"read",
"read_cross_cluster",
"view_index_metadata"
],
"query": "{ "match": { "observer.name": "dts" }} "
}
],

[Susfubar]

Found its a subscription feature of elastic.

[itdeveloper50]

how did you resolve that? I mean, how to remove subscription feature of elastic?
Or is it necessary to subscribe?
Thanks.