# Is is possible to secure ES indices based on a client ID?

**URL:** <https://discuss.elastic.co/t/is-is-possible-to-secure-es-indices-based-on-a-client-id/69181>\
**Category:** Elasticsearch\
**Created:** [December 15, 2016, 3:13pm UTC](https://discuss.elastic.co/t/is-is-possible-to-secure-es-indices-based-on-a-client-id/69181 "2016-12-15T15:13:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![baden0x1](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@baden0x1](https://discuss.elastic.co/u/baden0x1)\
**Post date:** [December 15, 2016, 3:13pm UTC](https://discuss.elastic.co/t/is-is-possible-to-secure-es-indices-based-on-a-client-id/69181/1 "2016-12-15T15:13:24Z")

</div>

In a forthcoming platform, we will have several clients accessing data through a dashboard. Is it possible to secure an ElasticSearch index based on a specific client ID?

I realize that this would require some master/lookup index, which would mean that we would also have an ES index with user data.

The driving force behind this is that we would like to secure each client's data so that other clients are not able to access others' indices by merely trying to guess a clientID.

For this my suggestion is that a after a request is received by the server, we tack on the client ID (server-side) before the request is sent to ElasticSearch.

To make this happen I would think that every document within all of a client's indices would have a _ClientID_ field. The request obviously starts with the index name, but the server will add their _ClientID_ (GUID), which would never be seen by the client themselves (an internal ID).

Suggestions please.

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 15, 2016, 3:31pm UTC](https://discuss.elastic.co/t/is-is-possible-to-secure-es-indices-based-on-a-client-id/69181/2 "2016-12-15T15:31:04Z")

</div>

Have a look at Xpack (commercial plugin made by elastic).

---

<div class="post-metadata">

**Author:** ![baden0x1](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@baden0x1](https://discuss.elastic.co/u/baden0x1)\
**Post date:** [December 17, 2016, 1:50pm UTC](https://discuss.elastic.co/t/is-is-possible-to-secure-es-indices-based-on-a-client-id/69181/3 "2016-12-17T13:50:45Z")

</div>

I have XPack installed. Can you please elaborate on how to accomplish this?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [December 17, 2016, 3:13pm UTC](https://discuss.elastic.co/t/is-is-possible-to-secure-es-indices-based-on-a-client-id/69181/4 "2016-12-17T15:13:14Z")

</div>

Here: [https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html](https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html)

---

<div class="post-metadata">

**Author:** ![baden0x1](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@baden0x1](https://discuss.elastic.co/u/baden0x1)\
**Post date:** [December 17, 2016, 9:29pm UTC](https://discuss.elastic.co/t/is-is-possible-to-secure-es-indices-based-on-a-client-id/69181/5 "2016-12-17T21:29:18Z")

</div>

Perfect, thank you - indexing data with an ingest pipeline.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2017, 9:29pm UTC](https://discuss.elastic.co/t/is-is-possible-to-secure-es-indices-based-on-a-client-id/69181/6 "2017-01-14T21:29:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.