# Document Level Permissions Filtering **URL:** https://discuss.elastic.co/t/document-level-permissions-filtering/7085 **Category:** Elasticsearch **Created:** [March 21, 2012, 12:23pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085 "2012-03-21T12:23:48Z") **Posts on this page:** 20 **Page:** 1
### Author: ![richardwhatever](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richardwhatever/32/2044_2.png) [@richardwhatever](https://discuss.elastic.co/u/richardwhatever) #### Post date: [March 21, 2012, 12:23pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/1 "2012-03-21T12:23:48Z")
Hi, I'm looking for a search engine that provides document level access / filtering. I had looked at ManifoldCF with Solr as one option. Does elasticsearch offer this kind of functionality? I need to be able to restrict search results in a granual way, whereby each document can have permissions set for each potential user of the system. Thanks, Richard. ---
### Author: ![vineeth\_mohan](https://avatars.discourse-cdn.com/v4/letter/v/bc79bd/32.png) [@vineeth\_mohan](https://discuss.elastic.co/u/vineeth_mohan) #### Post date: [March 23, 2012, 6:50pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/2 "2012-03-23T18:50:43Z")
you will have to implement that on proxy level or something. Like you need to set a permission level on each document or type or even index. And when a user query comes , incercept the query in between using a proxy or something , see if the user have permission and then only let it through. Thanks Vineeth On Wed, Mar 21, 2012 at 5:53 PM, Richard Brown [richardwhatever@gmail.com](mailto:richardwhatever@gmail.com)wrote: > Hi, > > I'm looking for a search engine that provides document level access / > filtering. I had looked at ManifoldCF with Solr as one option. Does > elasticsearch offer this kind of functionality? I need to be able to > restrict search results in a granual way, whereby each document can have > permissions set for each potential user of the system. > > Thanks, > > Richard. ---
### Author: ![Michael\_Sick](https://avatars.discourse-cdn.com/v4/letter/m/22d042/32.png) [@Michael\_Sick](https://discuss.elastic.co/u/Michael_Sick) #### Post date: [March 23, 2012, 7:15pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/3 "2012-03-23T19:15:47Z")
Shay, Building on this question, are you considering adding an internal security model to ES? If so, have you looked at what was done in the Apache Accumulo project? Short story, this was a Big Table implementation built out by the US Intelligence Community and built out a finer grained security model that still scaled. If you are considering adding ES security, I'm curious if you think this level of granularity is desirable/feasible. [http://incubator.apache.org/accumulo/user\_manual\_1.4-incubating/Security.html](http://incubator.apache.org/accumulo/user_manual_1.4-incubating/Security.html) --Mike On Fri, Mar 23, 2012 at 2:50 PM, Vineeth Mohan [vineethmohan@algotree.com](mailto:vineethmohan@algotree.com)wrote: > you will have to implement that on proxy level or something. > Like you need to set a permission level on each document or type or even > index. > And when a user query comes , incercept the query in between using a proxy > or something , see if the user have permission and then only let it through. > > Thanks > Vineeth > > On Wed, Mar 21, 2012 at 5:53 PM, Richard Brown [richardwhatever@gmail.com](mailto:richardwhatever@gmail.com)wrote: > > > Hi, > > > > I'm looking for a search engine that provides document level access / > > filtering. I had looked at ManifoldCF with Solr as one option. Does > > elasticsearch offer this kind of functionality? I need to be able to > > restrict search results in a granual way, whereby each document can have > > permissions set for each potential user of the system. > > > > Thanks, > > > > Richard. ---
### Author: ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante) #### Post date: [March 25, 2012, 11:46am UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/4 "2012-03-25T11:46:53Z")
Security in search engines is a wide subject. The "small solution" is just to hand over authorization tokens, index them, and later add filters to all queries automatically. This could be done by a web front-end proxy placed before the Elasticsearch index/search REST API. I think the most preferred way to have document-level security would be a "big solution", i.e. writing an Elasticsearch security plugin with the following features included - transport layer security between client and server (TLS) - server awareness of client identity (establish ACL/role based security) - secure indexing: only allow authorized clients to write documents (perform ACL/role-based checks) - secure query: index visibility, document visibility, filter query results due to client authorization - enforce document / index data integrity (checksums, end-to-end security) - constraint violation alerting - and, really advanced stuff, adjust highlighting to filter out sensitive (restricted) fields (privacy) - even more "paranoid" stuff Most of the work could be taken over by front-end web processes, and the Elasticsearch security plugin could offer some conventions for a security model, i.e. rules for where index/document-level TLS/ACL/Role stuff is stored and how it is used by clients via a REST API. Best regards, Jörg ---
### Author: ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy) #### Post date: [March 25, 2012, 12:51pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/5 "2012-03-25T12:51:38Z")
Agreed, security / ACL is a big topic. For document level one, the best way is to associate the relevant data with each document, and filter by it. On Sun, Mar 25, 2012 at 1:46 PM, Jörg Prante [joergprante@gmail.com](mailto:joergprante@gmail.com) wrote: > Security in search engines is a wide subject. > > The "small solution" is just to hand over authorization tokens, index > them, and later add filters to all queries automatically. This could be > done by a web front-end proxy placed before the Elasticsearch index/search > REST API. > > I think the most preferred way to have document-level security would be a > "big solution", i.e. writing an Elasticsearch security plugin with the > following features included > > - transport layer security between client and server (TLS) > - server awareness of client identity (establish ACL/role based security) > - secure indexing: only allow authorized clients to write documents > (perform ACL/role-based checks) > - secure query: index visibility, document visibility, filter query > results due to client authorization > - enforce document / index data integrity (checksums, end-to-end security) > - constraint violation alerting > - and, really advanced stuff, adjust highlighting to filter out sensitive > (restricted) fields (privacy) > - even more "paranoid" stuff > > Most of the work could be taken over by front-end web processes, and the > Elasticsearch security plugin could offer some conventions for a security > model, i.e. rules for where index/document-level TLS/ACL/Role stuff is > stored and how it is used by clients via a REST API. > > Best regards, > > Jörg ---
### Author: ![richardwhatever](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richardwhatever/32/2044_2.png) [@richardwhatever](https://discuss.elastic.co/u/richardwhatever) #### Post date: [April 5, 2012, 6:17pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/6 "2012-04-05T18:17:09Z")
Hi Vineeth, Sorry for delay in response, i was out of the country. My requirements are not about filtering the incoming search queries, but rather about restricting the indexed documents to ones a user has permission to search... i think it has to be done by the search engine or paging etc would not work properly. Regards, Richard On 23 March 2012 18:50, Vineeth Mohan [vineethmohan@algotree.com](mailto:vineethmohan@algotree.com) wrote: > you will have to implement that on proxy level or something. > Like you need to set a permission level on each document or type or even > index. > And when a user query comes , incercept the query in between using a proxy > or something , see if the user have permission and then only let it through. > > Thanks > Vineeth > > On Wed, Mar 21, 2012 at 5:53 PM, Richard Brown [richardwhatever@gmail.com](mailto:richardwhatever@gmail.com)wrote: > > > Hi, > > > > I'm looking for a search engine that provides document level access / > > filtering. I had looked at ManifoldCF with Solr as one option. Does > > elasticsearch offer this kind of functionality? I need to be able to > > restrict search results in a granual way, whereby each document can have > > permissions set for each potential user of the system. > > > > Thanks, > > > > Richard. -- _Richard Brown_ @richardwhatever [uk.linkedin.com/in/richardbrownni](http://uk.linkedin.com/in/richardbrownni) ---
### Author: ![kimchy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kimchy/32/44952_2.png) [@kimchy](https://discuss.elastic.co/u/kimchy) #### Post date: [April 7, 2012, 3:39pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/7 "2012-04-07T15:39:41Z")
If you add relevant security aspects to the documents indexed, you can filter by them. On Thu, Apr 5, 2012 at 9:17 PM, Richard Brown [richardwhatever@gmail.com](mailto:richardwhatever@gmail.com)wrote: > Hi Vineeth, > > Sorry for delay in response, i was out of the country. > > My requirements are not about filtering the incoming search queries, but > rather about restricting the indexed documents to ones a user has > permission to search... i think it has to be done by the search engine or > paging etc would not work properly. > > Regards, > > Richard > > On 23 March 2012 18:50, Vineeth Mohan [vineethmohan@algotree.com](mailto:vineethmohan@algotree.com) wrote: > > > you will have to implement that on proxy level or something. > > Like you need to set a permission level on each document or type or even > > index. > > And when a user query comes , incercept the query in between using a > > proxy or something , see if the user have permission and then only let it > > through. > > > > Thanks > > Vineeth > > > > On Wed, Mar 21, 2012 at 5:53 PM, Richard Brown \<[richardwhatever@gmail.com](mailto:richardwhatever@gmail.com) > > > > > wrote: > > > > > Hi, > > > > > > I'm looking for a search engine that provides document level access / > > > filtering. I had looked at ManifoldCF with Solr as one option. Does > > > elasticsearch offer this kind of functionality? I need to be able to > > > restrict search results in a granual way, whereby each document can have > > > permissions set for each potential user of the system. > > > > > > Thanks, > > > > > > Richard. > > -- > _Richard Brown_ > @richardwhatever > [uk.linkedin.com/in/richardbrownni](http://uk.linkedin.com/in/richardbrownni) ---
### Author: ![Yann\_Barraud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yann_barraud/32/1108_2.png) [@Yann\_Barraud](https://discuss.elastic.co/u/Yann_Barraud) #### Post date: [November 21, 2012, 10:57am UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/8 "2012-11-21T10:57:48Z")
Hi Richard & all, Did you find a solution for this problem ? I have quite the same requirments/ questions about differents sources (out of ManifoldCF that seems to manage the whole bunch).... Thanks. Yann Le jeudi 5 avril 2012 20:17:09 UTC+2, Richard Brown a écrit : > Hi Vineeth, > > Sorry for delay in response, i was out of the country. > > My requirements are not about filtering the incoming search queries, but > rather about restricting the indexed documents to ones a user has > permission to search... i think it has to be done by the search engine or > paging etc would not work properly. > > Regards, > > Richard > > On 23 March 2012 18:50, Vineeth Mohan \<[vineet...@algotree.com](mailto:vineet...@algotree.com)\ > > > wrote: > > > you will have to implement that on proxy level or something. > > Like you need to set a permission level on each document or type or even > > index. > > And when a user query comes , incercept the query in between using a > > proxy or something , see if the user have permission and then only let it > > through. > > > > Thanks > > Vineeth > > > > On Wed, Mar 21, 2012 at 5:53 PM, Richard Brown \<[richard...@gmail.com](mailto:richard...@gmail.com)\ > > > > > wrote: > > > > > Hi, > > > > > > I'm looking for a search engine that provides document level access / > > > filtering. I had looked at ManifoldCF with Solr as one option. Does > > > elasticsearch offer this kind of functionality? I need to be able to > > > restrict search results in a granual way, whereby each document can have > > > permissions set for each potential user of the system. > > > > > > Thanks, > > > > > > Richard. > > -- > _Richard Brown_ > @richardwhatever > [uk.linkedin.com/in/richardbrownni](http://uk.linkedin.com/in/richardbrownni) -- ---
### Author: ![richardwhatever](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richardwhatever/32/2044_2.png) [@richardwhatever](https://discuss.elastic.co/u/richardwhatever) #### Post date: [November 22, 2012, 5:36pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/9 "2012-11-22T17:36:41Z")
Hi Yann, No, I didn't implement a Solr Solution as yet. Currently looking into using RavenDB instead as its based on [lucene.net](http://lucene.net), but with security built in. Richard On 21 November 2012 10:57, Yann Barraud [yann.barraud@gmail.com](mailto:yann.barraud@gmail.com) wrote: > Hi Richard & all, > > Did you find a solution for this problem ? I have quite the same > requirments/ questions about differents sources (out of ManifoldCF that > seems to manage the whole bunch).... > > Thanks. > Yann > Le jeudi 5 avril 2012 20:17:09 UTC+2, Richard Brown a écrit : > > > Hi Vineeth, > > > > Sorry for delay in response, i was out of the country. > > > > My requirements are not about filtering the incoming search queries, but > > rather about restricting the indexed documents to ones a user has > > permission to search... i think it has to be done by the search engine or > > paging etc would not work properly. > > > > Regards, > > > > Richard > > > > On 23 March 2012 18:50, Vineeth Mohan [vineet...@algotree.com](mailto:vineet...@algotree.com) wrote: > > > > > you will have to implement that on proxy level or something. > > > Like you need to set a permission level on each document or type or even > > > index. > > > And when a user query comes , incercept the query in between using a > > > proxy or something , see if the user have permission and then only let it > > > through. > > > > > > Thanks > > > Vineeth > > > > > > On Wed, Mar 21, 2012 at 5:53 PM, Richard Brown [richard...@gmail.com](mailto:richard...@gmail.com)wrote: > > > > > > > Hi, > > > > > > > > I'm looking for a search engine that provides document level access / > > > > filtering. I had looked at ManifoldCF with Solr as one option. Does > > > > elasticsearch offer this kind of functionality? I need to be able to > > > > restrict search results in a granual way, whereby each document can have > > > > permissions set for each potential user of the system. > > > > > > > > Thanks, > > > > > > > > Richard. > > > > -- > > _Richard Brown_ > > @richardwhatever > > [uk.linkedin.com/in/\*\*richardbrownni](http://uk.linkedin.com/in/**richardbrownni)[http://uk.linkedin.com/in/richardbrownni](http://uk.linkedin.com/in/richardbrownni) > > > > -- -- _Richard Brown_ @richardwhatever [uk.linkedin.com/in/richardbrownni](http://uk.linkedin.com/in/richardbrownni) -- ---
### Author: ![Lukas\_Vlcek1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas_vlcek1/32/819_2.png) [@Lukas\_Vlcek1](https://discuss.elastic.co/u/Lukas_Vlcek1) #### Post date: [November 23, 2012, 8:37am UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/10 "2012-11-23T08:37:35Z")
Hi, May be not useful idea in your particular use case but in many organizations document-user visibility is driven by organization structure/groups, i.e. not really at the level of individual documents. If that would fit to your situation then you can consider indexing documents into indices by "organization departments" and then allow users to search across relevant indices only. Also index aliases could be useful in this scenario. Just an idea. Regards, Lukáš -- ---
### Author: ![Hendrik](https://avatars.discourse-cdn.com/v4/letter/h/839c29/32.png) [@Hendrik](https://discuss.elastic.co/u/Hendrik) #### Post date: [October 31, 2013, 10:55am UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/11 "2013-10-31T10:55:31Z")
Started this to fulfill our company needs: > **[GitHub - salyh/elasticsearch-security-plugin: Kerberos, LDAP, Active...](https://github.com/salyh/elasticsearch-security-plugin)** > > Kerberos, LDAP, Active Directory, PKI/SSL/TLS and host/ip based ACL coarse-grained and document level security for elasticsearch (Authentication, Authorization, Auth, Spnego, ACL, Mutual authentica... Am Sonntag, 25. März 2012 13:46:53 UTC+2 schrieb Jörg Prante: > Security in search engines is a wide subject. > > The "small solution" is just to hand over authorization tokens, index > them, and later add filters to all queries automatically. This could be > done by a web front-end proxy placed before the Elasticsearch index/search > REST API. > > I think the most preferred way to have document-level security would be a > "big solution", i.e. writing an Elasticsearch security plugin with the > following features included > > - transport layer security between client and server (TLS) > - server awareness of client identity (establish ACL/role based security) > - secure indexing: only allow authorized clients to write documents > (perform ACL/role-based checks) > - secure query: index visibility, document visibility, filter query > results due to client authorization > - enforce document / index data integrity (checksums, end-to-end security) > - constraint violation alerting > - and, really advanced stuff, adjust highlighting to filter out sensitive > (restricted) fields (privacy) > - even more "paranoid" stuff > > Most of the work could be taken over by front-end web processes, and the > Elasticsearch security plugin could offer some conventions for a security > model, i.e. rules for where index/document-level TLS/ACL/Role stuff is > stored and how it is used by clients via a REST API. > > Best regards, > > Jörg -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
### Author: ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante) #### Post date: [October 31, 2013, 1:59pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/12 "2013-10-31T13:59:25Z")
Great effort. Do you plan to add JAAS? Cheers, Jörg -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
### Author: ![Hendrik](https://avatars.discourse-cdn.com/v4/letter/h/839c29/32.png) [@Hendrik](https://discuss.elastic.co/u/Hendrik) #### Post date: [November 6, 2013, 11:34am UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/13 "2013-11-06T11:34:07Z")
yes (via tomcat), but i guess the focus will be on kerberos. My long term plan is to add also things like: - encryption for fs index store - stuff like [GitHub - jstoneham/elasticsearch-accumulo-security: Use the Accumulo ColumnVisibility security model to control access to your ElasticSearch documents.](https://github.com/texeltek/elasticsearch-accumulo-security) Am Donnerstag, 31. Oktober 2013 14:59:25 UTC+1 schrieb Jörg Prante: > Great effort. Do you plan to add JAAS? > > Cheers, > > Jörg -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
### Author: ![Hendrik](https://avatars.discourse-cdn.com/v4/letter/h/839c29/32.png) [@Hendrik](https://discuss.elastic.co/u/Hendrik) #### Post date: [November 20, 2013, 9:15am UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/14 "2013-11-20T09:15:22Z")
there is some progress here: [https://groups.google.com/forum/?fromgroups#!topic/elasticsearch/tavroa3Nw5g](https://groups.google.com/forum/?fromgroups#!topic/elasticsearch/tavroa3Nw5g) Am Mittwoch, 6. November 2013 12:34:07 UTC+1 schrieb Hendrik: > yes (via tomcat), but i guess the focus will be on kerberos. > My long term plan is to add also things like: > > - encryption for fs index store > - stuff like [GitHub - jstoneham/elasticsearch-accumulo-security: Use the Accumulo ColumnVisibility security model to control access to your ElasticSearch documents.](https://github.com/texeltek/elasticsearch-accumulo-security) > > Am Donnerstag, 31. Oktober 2013 14:59:25 UTC+1 schrieb Jörg Prante: > > > Great effort. Do you plan to add JAAS? > > > > Cheers, > > > > Jörg -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
### Author: ![Hendrik](https://avatars.discourse-cdn.com/v4/letter/h/839c29/32.png) [@Hendrik](https://discuss.elastic.co/u/Hendrik) #### Post date: [December 11, 2013, 3:53pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/15 "2013-12-11T15:53:05Z")
Maybe this is interesting for you > **[GitHub - salyh/elasticsearch-security-plugin: Kerberos, LDAP, Active...](https://github.com/salyh/elasticsearch-security-plugin)** > > Kerberos, LDAP, Active Directory, PKI/SSL/TLS and host/ip based ACL coarse-grained and document level security for elasticsearch (Authentication, Authorization, Auth, Spnego, ACL, Mutual authentica... Am Donnerstag, 22. November 2012 18:37:05 UTC+1 schrieb Richard Brown: > Hi Yann, > > No, I didn't implement a Solr Solution as yet. Currently looking into > using RavenDB instead as its based on [lucene.net](http://lucene.net), but with security built > in. > > Richard > > On 21 November 2012 10:57, Yann Barraud \<[yann.b...@gmail.com](mailto:yann.b...@gmail.com) \ > > > wrote: > > > Hi Richard & all, > > > > Did you find a solution for this problem ? I have quite the same > > requirments/ questions about differents sources (out of ManifoldCF that > > seems to manage the whole bunch).... > > > > Thanks. > > Yann > > Le jeudi 5 avril 2012 20:17:09 UTC+2, Richard Brown a écrit : > > > > > Hi Vineeth, > > > > > > Sorry for delay in response, i was out of the country. > > > > > > My requirements are not about filtering the incoming search queries, but > > > rather about restricting the indexed documents to ones a user has > > > permission to search... i think it has to be done by the search engine or > > > paging etc would not work properly. > > > > > > Regards, > > > > > > Richard > > > > > > On 23 March 2012 18:50, Vineeth Mohan [vineet...@algotree.com](mailto:vineet...@algotree.com) wrote: > > > > > > > you will have to implement that on proxy level or something. > > > > Like you need to set a permission level on each document or type or > > > > even index. > > > > And when a user query comes , incercept the query in between using a > > > > proxy or something , see if the user have permission and then only let it > > > > through. > > > > > > > > Thanks > > > > Vineeth > > > > > > > > On Wed, Mar 21, 2012 at 5:53 PM, Richard Brown [richard...@gmail.com](mailto:richard...@gmail.com)wrote: > > > > > > > > > Hi, > > > > > > > > > > I'm looking for a search engine that provides document level access / > > > > > filtering. I had looked at ManifoldCF with Solr as one option. Does > > > > > elasticsearch offer this kind of functionality? I need to be able to > > > > > restrict search results in a granual way, whereby each document can have > > > > > permissions set for each potential user of the system. > > > > > > > > > > Thanks, > > > > > > > > > > Richard. > > > > > > -- > > > _Richard Brown_ > > > @richardwhatever > > > [uk.linkedin.com/in/richardbrownni](http://uk.linkedin.com/in/richardbrownni) > > > > > > -- > > -- > _Richard Brown_ > @richardwhatever > [uk.linkedin.com/in/richardbrownni](http://uk.linkedin.com/in/richardbrownni) -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/b2747756-f386-4118-a8e3-6489be218a36%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/b2747756-f386-4118-a8e3-6489be218a36%40googlegroups.com). For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out). ---
### Author: ![ajoealex](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@ajoealex](https://discuss.elastic.co/u/ajoealex) #### Post date: [June 26, 2016, 4:42pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/16 "2016-06-26T16:42:12Z")
Hi, Have you implemented this? Can you please give me an idea. I am planning to use kibana for search. If we index user\_id or someother data of a document, how do we filter it in user search. ---
### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet) #### Post date: [June 26, 2016, 6:02pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/17 "2016-06-26T18:02:29Z")
You could use a filtered alias and add something like ngnix on top of Elasticsearch. Or use Shield. ---
### Author: ![ajoealex](https://avatars.discourse-cdn.com/v4/letter/a/45deac/32.png) [@ajoealex](https://discuss.elastic.co/u/ajoealex) #### Post date: [June 26, 2016, 6:16pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/18 "2016-06-26T18:16:55Z")
Is it possible to give document level permission in shield? ---
### Author: ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet) #### Post date: [June 26, 2016, 7:15pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/19 "2016-06-26T19:15:40Z")
Yes. See [https://www.elastic.co/guide/en/shield/current/setting-up-field-and-document-level-security.html](https://www.elastic.co/guide/en/shield/current/setting-up-field-and-document-level-security.html) ---
### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system) #### Post date: [July 5, 2017, 10:40pm UTC](https://discuss.elastic.co/t/document-level-permissions-filtering/7085/20 "2017-07-05T22:40:24Z")