# Elasticsearch permissions through LUA?

**URL:** <https://discuss.elastic.co/t/elasticsearch-permissions-through-lua/81272>\
**Category:** Elasticsearch\
**Created:** [April 5, 2017, 8:27am UTC](https://discuss.elastic.co/t/elasticsearch-permissions-through-lua/81272 "2017-04-05T08:27:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yaswanth](https://avatars.discourse-cdn.com/v4/letter/y/94ad74/32.png) [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\
**Post date:** [April 5, 2017, 8:27am UTC](https://discuss.elastic.co/t/elasticsearch-permissions-through-lua/81272/1 "2017-04-05T08:27:36Z")

</div>

Hi,

For enabling security in ES i used Nginx with Lua and got some sample code from [github](https://gist.github.com/philwinder/5ec7628c6687794029b3) . In that i am not clear at some part of code.

uri: [http://localhost/\_get](http://localhost/_get)  
path:\_get

for path, methods in pairs(restrictions[role]) do  
-- path matched rules?  
local p = string.match(uri, path) `//here p contains "get"`

-- method matched rules?  
local m = nil  
for \_, \_method in pairs(methods) do  
m = m and m or string.match(method, \_method) `// what does this step will do?`  
end

if p and m then  
allowed = true  
break  
end  
end

if not allowed then  
return write403Message()  
end

Correct me if i am wrong..  
Any help is highly appreciated..  
Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2017, 8:27am UTC](https://discuss.elastic.co/t/elasticsearch-permissions-through-lua/81272/2 "2017-05-03T08:27:52Z")

</div>

Closed on May 3, 2017, 8:27am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.