# Issue with document-level security expression and date range

**URL:** <https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 13, 2021, 12:57am UTC](https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197 "2021-02-13T00:57:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mattvl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattvl/32/83862_2.png) [@mattvl](https://discuss.elastic.co/u/mattvl)\
**Post date:** [February 13, 2021, 12:57am UTC](https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197/1 "2021-02-13T00:57:00Z")

</div>

I am having the same issue as [https://discuss.elastic.co/t/granted-documents-query-with-filter-by-timestamp/201834](https://discuss.elastic.co/t/granted-documents-query-with-filter-by-timestamp/201834) and [https://discuss.elastic.co/t/document-level-security-combining-queries-together/136143](https://discuss.elastic.co/t/document-level-security-combining-queries-together/136143)

```auto
{
      "bool": {
        "must": [
          {
            "terms": {
              "name": [
                "John"
              ]
            }
          },
          {
            "range": {
              "birthdate": {
                "gte": "now-30y"
              }
            }
          }
        ]
      }
    }

```

I am getting the following error message when I try to search the index with a user linked to the Role:

```auto
 Request failed to execute. Call: Status code 400 from: POST /users/_search?typed_keys=true. ServerError: Type: search_phase_execution_exception Reason: "all shards failed" CausedBy: "Type: parse_exception Reason: "could not read the current timestamp" CausedBy: "Type: illegal_argument_exception Reason: "'now' is not allowed in DLS queries"""

```

I am not sure why because now is perfectly parsed in DSL queries in Kibana Discovery for example. Do you have any idea on how to create a document-level security role with a relative date to now?

Thanks.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [February 13, 2021, 10:10am UTC](https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197/2 "2021-02-13T10:10:04Z")

</div>

There are some limitation, check this link 🙂

- [Date math](https://www.elastic.co/guide/en/elasticsearch/reference/current/common-options.html#date-math) expressions cannot contain `now` in [range queries with date fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-range-query.html#ranges-on-dates)

> **[Security limitations | Elasticsearch Reference \[7.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-limitations.html#field-document-limitations)**

---

<div class="post-metadata">

**Author:** ![mattvl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mattvl/32/83862_2.png) [@mattvl](https://discuss.elastic.co/u/mattvl)\
**Post date:** [February 13, 2021, 11:53am UTC](https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197/3 "2021-02-13T11:53:10Z")

</div>

Thank you @ylasri for pointing me to that page. Somehow I had overlooked it and couldn't get to it while searching for the error I was getting.  
Do you think there may be an alternate way of applying that document-level security expression?

I'm trying to use these role-based expressions to limit the data that different applications/users can see from the elasticsearch instance. That way, I won't have to "manually" apply them in every application that gets data from elasticsearch.

One of the business rules has a relative-to-now date range (e.g. some users cannot see documents older than 10 months), it would be a pity not being able to use this awesome security features only for that.

Thanks.

---

<div class="post-metadata">

**Author:** ![ylasri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ylasri/32/86120_2.png) [@ylasri](https://discuss.elastic.co/u/ylasri)\
**Post date:** [February 13, 2021, 10:37pm UTC](https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197/4 "2021-02-13T22:37:48Z")

</div>

> [@Range query in doc lvl security](https://discuss.elastic.co/t/range-query-in-doc-lvl-security/254431/2):
>
> There's no great solution. Typically we would recommend that you control that via indices. Have a daily index (or the minimum granularity you really need) and either: move them in/out of an alias each day (potentially you could use ILM to do something here) rewrite the role every day to change which indices it has access to It's also possible to do something with a custom roles provider (in Java), though there are some caching issues to deal with. Use an index per day as above, but have ro…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2021, 10:38pm UTC](https://discuss.elastic.co/t/issue-with-document-level-security-expression-and-date-range/264197/5 "2021-03-13T22:38:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.