Permission filtering using current time

Elastic Stack Elasticsearch
1

Hello,

I'm trying to create a role using the following query:

"range": {
  "a_date_field": {
    "gte": "now-1M/d"
  }
}

The intent is to only allow access to last month's data. Elastic returns permission filters are not allowed to use the current timestamp. I just want to confirm that I can't use now in permission filtering. Is that right? Thank you.

2

That is correct. It is not possible to use now within a Document Level Security query.

The simplest solution that I can think of, is to have an external process that uses the API to update your role definition every day at midnight.