# Query documents to match a value in a sublist of a list

**URL:** <https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831>\
**Category:** Elasticsearch\
**Created:** [October 30, 2020, 3:03pm UTC](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831 "2020-10-30T15:03:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [October 30, 2020, 3:03pm UTC](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831/1 "2020-10-30T15:03:13Z")

</div>

I am storing windows folder permissions in elastic as a document per folder, then each folder has a list of users that has access to this folder, and each user has list of permissions (accessmask) that is stored as a list of each user because it is a FlagsAttribute.

Sample structure for folder c:\folder with 2 users permissions

```auto
    {
      "path": "C:\\folder1",
      "permissions": [
        {
          "user": "domain\\user1",
          "ntfsAccessMask": [
            0,
            1,
            1,
            2,
            2,
            4,
            4,
            8,
            16,
            32,
            32,
            128,
            256,
            278,
            65536,
            131072,
            131209,
            131241,
            197055,
            1048576
          ]
        },
        {
          "user": "domain\\user2",
          "ntfsAccessMask": [
            0,
            1,
            1,
            2,
            2,
            4,
            4,
            8,
            16,
            32,
            32,
            64,
            128,
            256,
            278,
            65536,
            131072,
            131209,
            131241,
            197055,
            262144,
            524288
          ]
        }
      ]
    }

```

My question is how can i query all folder/users that has a specific permission like full control or a specific flag permission in the accessmask? it is possible to do this queries to match a value inside a sublist of a list of a doc?

queries like:

folders where f.path=\* and f.user=\* and ( f.user.ntfsaccessmask = 1 or f.user.nftsaccessmask = 2 )

---

<div class="post-metadata">

**Author:** ![agonzalez](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@agonzalez](https://discuss.elastic.co/u/agonzalez)\
**Post date:** [November 3, 2020, 11:39am UTC](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831/2 "2020-11-03T11:39:46Z")

</div>

anyone can help on this?

---

<div class="post-metadata">

**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\
**Post date:** [November 3, 2020, 2:44pm UTC](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831/3 "2020-11-03T14:44:55Z")

</div>

I suggest you flat your data, such as:

```
   {
  "path": "C:\\folder1",
  "user": "domain\\user1",
  "ntfsAccessMask": [
    0,
    1,
    1,
    2,
    2,
    4,
    4,
    8,
    16,
    32,
    32,
    128,
    256,
    278,
    65536,
    131072,
    131209,
    131241,
    197055,
    1048576
  ]
},
{
  "path": "C:\\folder1",
  "user": "domain\\user2",
  "ntfsAccessMask": [
    0,
    1,
    1,
    2,
    2,
    4,
    4,
    8,
    16,
    32,
    32,
    64,
    128,
    256,
    278,
    65536,
    131072,
    131209,
    131241,
    197055,
    262144,
    524288
  ]
}

```

Sample data structute you posted will store all user permissions in one single doc, you will get all users in this doc when one user permission hits.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 1, 2020, 2:44pm UTC](https://discuss.elastic.co/t/query-documents-to-match-a-value-in-a-sublist-of-a-list/253831/4 "2020-12-01T14:44:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.