# DLS range query is failing: permission filters are not allowed to use the current timestamp

**URL:** <https://discuss.elastic.co/t/dls-range-query-is-failing-permission-filters-are-not-allowed-to-use-the-current-timestamp/175321>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 4, 2019, 6:07am UTC](https://discuss.elastic.co/t/dls-range-query-is-failing-permission-filters-are-not-allowed-to-use-the-current-timestamp/175321 "2019-04-04T06:07:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nkoothrappahli](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nkoothrappahli/32/31959_2.png) [@nkoothrappahli](https://discuss.elastic.co/u/nkoothrappahli)\
**Post date:** [April 4, 2019, 6:08am UTC](https://discuss.elastic.co/t/dls-range-query-is-failing-permission-filters-are-not-allowed-to-use-the-current-timestamp/175321/1 "2019-04-04T06:08:00Z")

</div>

I try to use the following query as a DLS (Document level security) query:

```auto
"range": {
  "@timestamp": {
    "gt": "now-1d"
  }
}

```

This is failing with the error message: "permission filters are not allowed to use the current timestamp" . Why is this not possible and how to solve it?

I did not found anything in the documentation about this. Docs just saing: "The specified query expects the same format as if it was defined in the search request and supports the **full Elasticsearch Query DSL**"

---

<div class="post-metadata">

**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\
**Post date:** [April 15, 2019, 10:46am UTC](https://discuss.elastic.co/t/dls-range-query-is-failing-permission-filters-are-not-allowed-to-use-the-current-timestamp/175321/2 "2019-04-15T10:46:02Z")

</div>

Hi @nkoothrappahli,

I think this has more to do with how DLS is implemented internally.  
The document cache is built per-segment, and `now` would keep changing all the time, requiring us to do cache invalidation for each query. This would not be performant.

There might be another way to solve your problem, but not knowing enough details its hard to suggest anything. Please share some details on the problem that you are trying to solve and we can come up with some solution.

Hope this helps.

Thanks and Regards,  
Yogesh Gaikwad

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 13, 2019, 10:59am UTC](https://discuss.elastic.co/t/dls-range-query-is-failing-permission-filters-are-not-allowed-to-use-the-current-timestamp/175321/3 "2019-05-13T10:59:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.