# Protect field values in elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 29, 2018, 9:57am UTC](https://discuss.elastic.co/t/protect-field-values-in-elasticsearch/158728 "2018-11-29T09:57:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![vphant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vphant/32/38233_2.png) [@vphant](https://discuss.elastic.co/u/vphant)\ **Post date:** [November 29, 2018, 9:57am UTC](https://discuss.elastic.co/t/protect-field-values-in-elasticsearch/158728/1 "2018-11-29T09:57:48Z")
I have a following structure in the elasticsearch index `"answers"` ``` {"can_view": ["F1", "F2", "F3"],"firstname": "John","lastname": "Black"} {"can_view": ["F1", "F2"],"firstname": "Jack","lastname": "Grey"} {"can_view": ["F2", "F3"],"firstname": "Adam","lastname": "Brown"} ``` I have setup XPack Security for elasticsearch. I have three users in the system: `F1`, `F2`, `F3`. I've added a role for securing documents with this request. ``` POST /_xpack/security/role/alias_read { "indices" : [ { "names": ["answers"], "privileges": ["read"], "query": { "template": { "source": { "match": { "can_view": "{{_user.username}}" } } } } } ] } ``` I've assigned this role `alias_read` to F1, F2 and F3 users. Now if I'm logged in as `F1` user, I am able to see only those documents. ``` {"can_view": ["F1", "F2", "F3"],"firstname": "John","lastname": "Black"} {"can_view": ["F1", "F2"],"firstname": "Jack","lastname": "Grey"} ``` If I'm logged in as F2 user, I am able to see only those documents ``` {"can_view": ["F1", "F2"],"firstname": "Jack","lastname": "Grey"} {"can_view": ["F2", "F3"],"name": "Adam","value": "Brown"} ``` That works just perfect and correct. **Now the question is if there is a way to do the similar protection but for concrete field values (not for entire documents and not for entire fields).** For example. I have a following structure in the elasticsearch index `"answers"` ``` {"firstname": {"can_view": ["F1", "F2", "F3"], "value": "John"} ,"lastname": {"can_view": ["F1"], "value":"Black"} } {"firstname": {"can_view": ["F3"], "value": "Jack"} ,"lastname": {"can_view": ["F2"], "value":"Grey"} } {"firstname": {"can_view": ["F3", "F1"], "value": "Adam"} ,"lastname": {"can_view": ["F2", "F3"], "value":"Brown"} } ``` What I'm trying to get is, if I'm logged in as a user `F1`, I should be able to see only those results: ``` {"firstname": {"can_view": ["F1", "F2", "F3"], "value": "John"} ,"lastname": {"can_view": ["F1"], "value":"Black"} } {"firstname": {"can_view": ["F3", "F1"], "value": "Adam"}} ``` If I'm logged in as a user `F2`, I should be able to see only those results: ``` {"firstname": {"can_view": ["F1", "F2", "F3"], "value": "John"}} {"lastname": {"can_view": ["F2"], "value":"Grey"} } {"lastname": {"can_view": ["F2", "F3"], "value":"Brown"} } ``` **So I would like to restrict concrete values for concrete users. Is there a way to do it in elasticsearch using xpack or maybe some other security package? Using roles or whatever?** Versions that I use are: _elasticsearch 6.5.1_ _kibana 6.5.1_ _X-Pack_ ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 29, 2018, 9:59am UTC](https://discuss.elastic.co/t/protect-field-values-in-elasticsearch/158728/2 "2018-11-29T09:59:04Z")
I think you may have posted this with some missing information, as it's not clear what you are after. ---
**Author:** ![vphant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vphant/32/38233_2.png) [@vphant](https://discuss.elastic.co/u/vphant)\ **Post date:** [November 29, 2018, 10:05am UTC](https://discuss.elastic.co/t/protect-field-values-in-elasticsearch/158728/3 "2018-11-29T10:05:55Z")
Sorry, I accidently posted a question with a missing information. I've now added everything and edited my question. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 29, 2018, 10:11am UTC](https://discuss.elastic.co/t/protect-field-values-in-elasticsearch/158728/4 "2018-11-29T10:11:37Z")
No, I don't think that is possible as field level security is applied for the index and not per document. ---
**Author:** ![vphant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vphant/32/38233_2.png) [@vphant](https://discuss.elastic.co/u/vphant)\ **Post date:** [November 29, 2018, 10:24am UTC](https://discuss.elastic.co/t/protect-field-values-in-elasticsearch/158728/5 "2018-11-29T10:24:47Z")
Is there a way to maybe somehow use a "nested query" in a template? ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [November 29, 2018, 10:28am UTC](https://discuss.elastic.co/t/protect-field-values-in-elasticsearch/158728/6 "2018-11-29T10:28:23Z")
I do not see how that would work, but someone else may have other suggestions. If each user was allowed to see the same fields across all documents I think you can do it through multiple roles though. If the number of permutations was reasonably low or you could group field access into a number of categories or groups you could perhaps also index different versions of the documents and then manage access by document. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 27, 2018, 10:28am UTC](https://discuss.elastic.co/t/protect-field-values-in-elasticsearch/158728/7 "2018-12-27T10:28:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.