Different roles on different fields on different documents

Elastic Security SIEM
1

Hi everyone, I have a question. I get a JSON like this

{
"took" : 271,
"timed_out" : false,
"_shards" : {
"total" : 1,
"successful" : 1,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : {
"value" : 4,
"relation" : "eq"
},
"max_score" : 1.0,
"hits" : [
{
"_index" : "test",
"_type" : "_doc",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"name" : ["John", "user1"],
"lastname" : ["Doe" ,"user2"],
"job_description" : ["Systems administrator and Linux specialist", "user3"]
}
},
{
"_index" : "test",
"_type" : "_doc",
"_id" : "2",
"_score" : 1.0,
"_source" : {
"name" : ["John", "user2"],
"lastname" : ["Doe", "user3"],
"job_description" : ["Systems administrator and Linux specialist", "user1"]
}
},
{
"_index" : "test",
"_type" : "_doc",
"_id" : "3",
"_score" : 1.0,
"_source" : {
"name" : ["John", "user3"],
"lastname" : ["Doe", "user1"],
"job_description" : ["Systems administrator and Linux specialist", "user2"]
}
}
]
}
}

different documents have different permission on different fields for example if I login to user1 and I want to find name = "John" I will see only document with _id 1 without fields that I don't have permission

  {
    "_index" : "test",
    "_type" : "_doc",
    "_id" : "1",
    "_score" : 1.0,
    "_source" : {
      "name" : ["John", "user1"]
    }
  }

any ideas how to do it?

2

Hi,

This might be possible to do with field level security but I'm not quite sure myself. I think you have a better chance to get an answer to this question if you open a topic in the Elasticsearch section, and apply the stack-security label.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.