# Document-level security query params
**URL:** https://discuss.elastic.co/t/document-level-security-query-params/108693
**Category:** Elasticsearch
**Created:** [November 22, 2017, 10:20am UTC](https://discuss.elastic.co/t/document-level-security-query-params/108693 "2017-11-22T10:20:47Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@hym](https://discuss.elastic.co/u/hym)
#### Post date: [November 22, 2017, 10:20am UTC](https://discuss.elastic.co/t/document-level-security-query-params/108693/1 "2017-11-22T10:20:47Z")
Hi all,
I am new in x-pack security module. I was wondering, I can use parameters having in the **main query** inside Doc-level query.
Actually, what I want to do is:
Having application level users which are different from elastic users, I want to filter the documents according to my application level user-names, not elastic user (because all my app users will connect by one elastic user)
Any help?
Thanks in advance
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 24, 2017, 9:13am UTC](https://discuss.elastic.co/t/document-level-security-query-params/108693/2 "2017-11-24T09:13:07Z")
No it is not possible for a role to apply parameters from the current query.
If you want to use 1 elasticsearch user, and have multiple application users, you might want to look at the `run-as` feature.
---
### Author:  [@hym](https://discuss.elastic.co/u/hym)
#### Post date: [November 25, 2017, 12:28pm UTC](https://discuss.elastic.co/t/document-level-security-query-params/108693/3 "2017-11-25T12:28:07Z")
Thanks, Tim,
I take a look at run-as feature as you mentioned but even in that case I need to create all my application users in Elsasticsearch user realm (native, file, LDAP or whatever) because the only way to use document level security is to define query on a role and then assign that role to the defined user. Am I right or there is another way to take advantage of this feature without having all users defined in Elasticsearch?
Maybe this is pretty similar to my original question but this time more general.
Is there any way to inject any parameter into the doc-level security query? for example, Sending this parameter in the header of submitted query?!
for example in run-as:
curl -H "es-security-runas-user: jacknich" -u es\_admin -XGET '[http://localhost:9200/](http://localhost:9200/)'
we are sending run as user as a header param and when it comes to doc-level query the \_user.username is 'jacknich'. Is there any way to send this kind of parameters by the submitted query and have access to that in doc-level query?
Thanks in advance
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [November 26, 2017, 1:23am UTC](https://discuss.elastic.co/t/document-level-security-query-params/108693/4 "2017-11-26T01:23:00Z")
You could use a custom realm, in conjunction with _run-as_, to do this.
Your system user would exist in a standard realm (native/LDAP/etc), with a role that grants `run-as: app-*`
Then you create a custom realm that supports user-lookups, but not authentication, and matches usernames of the form `app-*`.
For each user that you need to lookup, you simply return a very lightweight user with a single `application-dls` role.
The `application-dls` role is a plain old native role, with a DLS query that is templated by username.
It requires some custom Java development, but it's quite straightforward.
---
### Author:  [@hym](https://discuss.elastic.co/u/hym)
#### Post date: [November 27, 2017, 8:27am UTC](https://discuss.elastic.co/t/document-level-security-query-params/108693/5 "2017-11-27T08:27:02Z")
Thanks Tim
So helpful
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 25, 2017, 8:27am UTC](https://discuss.elastic.co/t/document-level-security-query-params/108693/6 "2017-12-25T08:27:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.