Encrypt Translog or completely disable it?

We implemented an ActionPlugin.
In the "onIndexModule" - Method we add a new IndexStore, that delivers a custom DirectoryFactory, that one a custom FSDirectory and that one is using encrypted Streams ... Our index template is configured so that this index store is used .

In the action filters of the plugin we intercept the HTTP headers sent to the node, that hold the key for the index and put it into a local cache (indexname to key) with 5 minutes eviction time. In the IOFactory we retrieve the key again from that cache.

Currently this only is failing in 2 situations:

  1. if a document update should be written into a replica shard on a non-master node, because then our ActionFilter is not called (I created another posting for this here)
  2. if the cluster is restarted and the index still is open => there we intend to close all indexes on shutdown and/or on startup (also another posting here) .

Do you have an idea regarding the Translog?

Or would it be possible, to re-merge the former funcationality to have a TranslogStore that could be customized ?

Cheers,
Martin