# Is it possible modify query results before aggregations **URL:** \ **Category:** Elasticsearch\ **Created:** [July 24, 2023, 9:36pm UTC](https://discuss.elastic.co/t/is-it-possible-modify-query-results-before-aggregations/339136 "2023-07-24T21:36:23Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Dalin](https://avatars.discourse-cdn.com/v4/letter/d/7ab992/32.png) [@Dalin](https://discuss.elastic.co/u/Dalin)\ **Post date:** [July 24, 2023, 9:36pm UTC](https://discuss.elastic.co/t/is-it-possible-modify-query-results-before-aggregations/339136/1 "2023-07-24T21:36:23Z")
I need to modify Elasticsearch query results based on user permissions determined by an external authorizer, before the results are used for aggregations. Anyone know if it's possible to intercept the query results, modify them, and return these results back to Elasticsearch right before aggregations are calculated using the modified results? ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [July 25, 2023, 8:52am UTC](https://discuss.elastic.co/t/is-it-possible-modify-query-results-before-aggregations/339136/2 "2023-07-25T08:52:19Z")
Hi @Dalin, Do the permissions definitely need to come from an external provider? There is document level permissions capabilities that can be configured in Elasticsearch as covered [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/document-level-security.html), but if the provider is external that might be tricky. Are you making use of an application layer to get the results from Elasticsearch? If so I would be inclined to do the authorizer exclusion logic and aggregation there. ---
**Author:** ![Dalin](https://avatars.discourse-cdn.com/v4/letter/d/7ab992/32.png) [@Dalin](https://discuss.elastic.co/u/Dalin)\ **Post date:** [July 25, 2023, 1:57pm UTC](https://discuss.elastic.co/t/is-it-possible-modify-query-results-before-aggregations/339136/3 "2023-07-25T13:57:46Z")
Hi @carly.richmond, Thank you for your response. Yes, in my case, the permissions do come from an external provider, specifically an application using OpenFGA as a base. I understand that Elasticsearch has document-level permissions capabilities, but I'm not sure if it's what I am aiming for since I have an external authorizer to provide permissions. DLS also requires me to specify the access permissions for each role, but the problem with that is hierarchical structures. I'm not sure how well DLS would handle that. As for the application layer, I do have one, but I'm trying to avoid performing the aggregation logic there due to the potential scalability issues. My goal is to let Elasticsearch handle the aggregations, but with the search results already filtered based on the user permissions from OpenFGA. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 22, 2023, 1:58pm UTC](https://discuss.elastic.co/t/is-it-possible-modify-query-results-before-aggregations/339136/4 "2023-08-22T13:58:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.