0

Is there a way to force a (query) filter to be executed for every query irrespective of whether or not it is present in the search query request? In my case, I have a native search script which is used to filter documents based on a dynamically changing list which is maintained outside of the elasticsearch instance. Since I do not control all the clients which query the server, I can't guarantee that they will do the filtering properly or add a reference to the script in the request and would therefore like to force the filter execution within the ES server itself. Is this (easily) achievable? (I am using ES 1.7.0/2.0)

TIA

MAC
  • 3
  • 1
  • 1
    [filtered aliases](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html#filtered) might be helpful – keety Jul 28 '15 at 22:14

2 Answers2

1

If users can submit arbitrary requests to the cluster, then there is absolutely nothing that you can do to stop them from doing whatever they want to do.

You really only have two options here:

  1. If users can select arbitrary queries/filters, but you control the index or indices that they go too, then you can use filtered aliases to limit what they can see.
  2. Use Shield (not free) to prevent arbitrary access to limit what indices/aliases any given request can access (with aliases using filters to hide data).
pickypg
  • 22,034
  • 5
  • 72
  • 84
0

Aliases are definitely the way to go. Create an alias per client if you need a different filter per client and ask him to talk to that alias.

Vineeth Mohan
  • 18,633
  • 8
  • 63
  • 77