# Question about use case: gmail-like "I can only see my own emails"?
**URL:** https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903
**Category:** Elasticsearch
**Created:** [February 9, 2011, 12:26pm UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903 "2011-02-09T12:26:58Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Peter\_Van\_Dijck](https://discuss.elastic.co/u/Peter_Van_Dijck)
#### Post date: [February 9, 2011, 12:26pm UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/1 "2011-02-09T12:26:58Z")
Hi,
newbie here. I have a question about a usecase. Evaluating using solr vs
elasticsearch.
The use case is this: we have many users, who each have their own list of
objects they can search. Think Gmail. I should be able to search my own
email, and you should not be able to hack the system to search my email.
I am hoping we can use elasticsearch's JSON api directly (so we don't have
to create our own json wrapper in between), but I'm not sure how
authentication works. Can I authenticate a user so that they can only search
their own email? Or once I authenticate, they can search the entire email
library of everyone?
Thanks for any pointers!
Cheers,
Peter
--
[http://petervandijck.com/](http://petervandijck.com/)
[http://twitter.com/petervandijck](http://twitter.com/petervandijck)
Skype id: peterkevandijck
USA tel (SkypeIn nr.): (646) 502-8604
---
### Author:  [@IvanBrusic](https://discuss.elastic.co/u/IvanBrusic)
#### Post date: [February 9, 2011, 4:24pm UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/2 "2011-02-09T16:24:19Z")
Hi Peter,
One option is to create an index per user. The mapping will be
consistent between indices. If there is no overlap between users (a
user will never have access to another user's content), then multiple
indices should work great.
ivan
On Feb 9, 7:26 am, Peter Van Dijck [petervandi...@gmail.com](mailto:petervandi...@gmail.com) wrote:
> Hi,
> newbie here. I have a question about a usecase. Evaluating using solr vs
> elasticsearch.
>
> The use case is this: we have many users, who each have their own list of
> objects they can search. Think Gmail. I should be able to search my own
> email, and you should not be able to hack the system to search my email.
>
> I am hoping we can use elasticsearch's JSON api directly (so we don't have
> to create our own json wrapper in between), but I'm not sure how
> authentication works. Can I authenticate a user so that they can only search
> their own email? Or once I authenticate, they can search the entire email
> library of everyone?
>
> Thanks for any pointers!
>
> Cheers,
> Peter
>
> --[http://petervandijck.com/](http://petervandijck.com/)[http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> Skype id: peterkevandijck
> USA tel (SkypeIn nr.): (646) 502-8604
---
### Author:  [@pcdinh](https://discuss.elastic.co/u/pcdinh)
#### Post date: [February 9, 2011, 4:35pm UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/3 "2011-02-09T16:35:40Z")
Not sure there is anything complicated here that you did not mention but I
think your requirement can be implemented quite simple: add a user\_id field
On Wed, Feb 9, 2011 at 7:26 PM, Peter Van Dijck [petervandijck@gmail.com](mailto:petervandijck@gmail.com)wrote:
> Hi,
> newbie here. I have a question about a usecase. Evaluating using solr vs
> elasticsearch.
>
> The use case is this: we have many users, who each have their own list of
> objects they can search. Think Gmail. I should be able to search my own
> email, and you should not be able to hack the system to search my email.
>
> I am hoping we can use elasticsearch's JSON api directly (so we don't have
> to create our own json wrapper in between), but I'm not sure how
> authentication works. Can I authenticate a user so that they can only search
> their own email? Or once I authenticate, they can search the entire email
> library of everyone?
>
> Thanks for any pointers!
>
> Cheers,
> Peter
>
> --
> [http://petervandijck.com/](http://petervandijck.com/)
> [http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> Skype id: peterkevandijck
> USA tel (SkypeIn nr.): (646) 502-8604
--
Spica Framework: [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/spica)
[http://www.twitter.com/pcdinh](http://www.twitter.com/pcdinh)
[http://groups.google.com/group/phpvietnam](http://groups.google.com/group/phpvietnam)
---
### Author:  [@Lukas\_Vlcek1](https://discuss.elastic.co/u/Lukas_Vlcek1)
#### Post date: [February 9, 2011, 4:44pm UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/4 "2011-02-09T16:44:04Z")
Hi,
How many users do you plan to support?
What kind of search do you plan to provide? Do you for example plan to
provide some search suggestions while user types in the search terms or
spell checking?
Regards,
Lukas
On Wed, Feb 9, 2011 at 1:26 PM, Peter Van Dijck [petervandijck@gmail.com](mailto:petervandijck@gmail.com)wrote:
> Hi,
> newbie here. I have a question about a usecase. Evaluating using solr vs
> elasticsearch.
>
> The use case is this: we have many users, who each have their own list of
> objects they can search. Think Gmail. I should be able to search my own
> email, and you should not be able to hack the system to search my email.
>
> I am hoping we can use elasticsearch's JSON api directly (so we don't have
> to create our own json wrapper in between), but I'm not sure how
> authentication works. Can I authenticate a user so that they can only search
> their own email? Or once I authenticate, they can search the entire email
> library of everyone?
>
> Thanks for any pointers!
>
> Cheers,
> Peter
>
> --
> [http://petervandijck.com/](http://petervandijck.com/)
> [http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> Skype id: peterkevandijck
> USA tel (SkypeIn nr.): (646) 502-8604 \<+16465028604\>
---
### Author:  [@Peter\_Van\_Dijck](https://discuss.elastic.co/u/Peter_Van_Dijck)
#### Post date: [February 9, 2011, 11:52pm UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/5 "2011-02-09T23:52:25Z")
Hi Ivan,
thanks. An index per user seems to make sense. There is (in our case) indeed
no overlap between users, although that may change in the future (but we
could figure it out then).
Peter
On Wed, Feb 9, 2011 at 11:24 AM, Ivan Brusic [ivan\_brusic@yahoo.com](mailto:ivan_brusic@yahoo.com) wrote:
> Hi Peter,
>
> One option is to create an index per user. The mapping will be
> consistent between indices. If there is no overlap between users (a
> user will never have access to another user's content), then multiple
> indices should work great.
>
> ivan
>
> On Feb 9, 7:26 am, Peter Van Dijck [petervandi...@gmail.com](mailto:petervandi...@gmail.com) wrote:
>
> > Hi,
> > newbie here. I have a question about a usecase. Evaluating using solr vs
> > elasticsearch.
> >
> > The use case is this: we have many users, who each have their own list of
> > objects they can search. Think Gmail. I should be able to search my own
> > email, and you should not be able to hack the system to search my email.
> >
> > I am hoping we can use elasticsearch's JSON api directly (so we don't
> > have
> > to create our own json wrapper in between), but I'm not sure how
> > authentication works. Can I authenticate a user so that they can only
> > search
> > their own email? Or once I authenticate, they can search the entire email
> > library of everyone?
> >
> > Thanks for any pointers!
> >
> > Cheers,
> > Peter
> >
> > --[http://petervandijck.com/](http://petervandijck.com/)[http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> > Skype id: peterkevandijck
> > USA tel (SkypeIn nr.): (646) 502-8604
--
[http://petervandijck.com/](http://petervandijck.com/)
[http://twitter.com/petervandijck](http://twitter.com/petervandijck)
Skype id: peterkevandijck
USA tel (SkypeIn nr.): (646) 502-8604
---
### Author:  [@Peter\_Van\_Dijck](https://discuss.elastic.co/u/Peter_Van_Dijck)
#### Post date: [February 9, 2011, 11:53pm UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/6 "2011-02-09T23:53:56Z")
Hey Lukáš,
- Hoping for millions of users.
- The kind of search is faceted search: ie. many objects (say, emails)
are tagged with tags in different facets. Pretty classic faceted browsing
approach, which is why we are looking at Solr and now elasticsearch.
- Search suggestions are nice but not a must have right now.
Peter
On Wed, Feb 9, 2011 at 11:44 AM, Lukáš Vlček [lukas.vlcek@gmail.com](mailto:lukas.vlcek@gmail.com) wrote:
> Hi,
>
> How many users do you plan to support?
> What kind of search do you plan to provide? Do you for example plan to
> provide some search suggestions while user types in the search terms or
> spell checking?
>
> Regards,
> Lukas
>
> On Wed, Feb 9, 2011 at 1:26 PM, Peter Van Dijck [petervandijck@gmail.com](mailto:petervandijck@gmail.com)wrote:
>
> > Hi,
> > newbie here. I have a question about a usecase. Evaluating using solr vs
> > elasticsearch.
> >
> > The use case is this: we have many users, who each have their own list of
> > objects they can search. Think Gmail. I should be able to search my own
> > email, and you should not be able to hack the system to search my email.
> >
> > I am hoping we can use elasticsearch's JSON api directly (so we don't have
> > to create our own json wrapper in between), but I'm not sure how
> > authentication works. Can I authenticate a user so that they can only search
> > their own email? Or once I authenticate, they can search the entire email
> > library of everyone?
> >
> > Thanks for any pointers!
> >
> > Cheers,
> > Peter
> >
> > --
> > [http://petervandijck.com/](http://petervandijck.com/)
> > [http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> > Skype id: peterkevandijck
> > USA tel (SkypeIn nr.): (646) 502-8604 \<+16465028604\>
--
[http://petervandijck.com/](http://petervandijck.com/)
[http://twitter.com/petervandijck](http://twitter.com/petervandijck)
Skype id: peterkevandijck
USA tel (SkypeIn nr.): (646) 502-8604
---
### Author:  [@Peter\_Van\_Dijck](https://discuss.elastic.co/u/Peter_Van_Dijck)
#### Post date: [February 9, 2011, 11:54pm UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/7 "2011-02-09T23:54:59Z")
Yes, but then couldn't user X just search for user Y's content if they know
user Y's userid?
My question is mostly around authentication: how do we avoid an app to
access ALL content, instead of only the content owned by the user that's
using it? This may be so simple I'm not seeing it..
Peter
On Wed, Feb 9, 2011 at 11:35 AM, Dinh [pcdinh@gmail.com](mailto:pcdinh@gmail.com) wrote:
> Not sure there is anything complicated here that you did not mention but I
> think your requirement can be implemented quite simple: add a user\_id field
>
> On Wed, Feb 9, 2011 at 7:26 PM, Peter Van Dijck [petervandijck@gmail.com](mailto:petervandijck@gmail.com)wrote:
>
> > Hi,
> > newbie here. I have a question about a usecase. Evaluating using solr vs
> > elasticsearch.
> >
> > The use case is this: we have many users, who each have their own list of
> > objects they can search. Think Gmail. I should be able to search my own
> > email, and you should not be able to hack the system to search my email.
> >
> > I am hoping we can use elasticsearch's JSON api directly (so we don't have
> > to create our own json wrapper in between), but I'm not sure how
> > authentication works. Can I authenticate a user so that they can only search
> > their own email? Or once I authenticate, they can search the entire email
> > library of everyone?
> >
> > Thanks for any pointers!
> >
> > Cheers,
> > Peter
> >
> > --
> > [http://petervandijck.com/](http://petervandijck.com/)
> > [http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> > Skype id: peterkevandijck
> > USA tel (SkypeIn nr.): (646) 502-8604
>
> --
> Spica Framework: [Google Code Archive - Long-term storage for Google Code Project Hosting.](http://code.google.com/p/spica)
> [http://www.twitter.com/pcdinh](http://www.twitter.com/pcdinh)
> [http://groups.google.com/group/phpvietnam](http://groups.google.com/group/phpvietnam)
--
[http://petervandijck.com/](http://petervandijck.com/)
[http://twitter.com/petervandijck](http://twitter.com/petervandijck)
Skype id: peterkevandijck
USA tel (SkypeIn nr.): (646) 502-8604
---
### Author:  [@Lukas\_Vlcek1](https://discuss.elastic.co/u/Lukas_Vlcek1)
#### Post date: [February 10, 2011, 1:22am UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/8 "2011-02-10T01:22:50Z")
Peter,
I think you should check with Shay if Elastic Search can scale to millions
of indices. (I do not think creating a new index per user is a way to go in
case of millions users.)
Which leads me to my other question. You can perfectly store more users into
one shared index and ensure that the logic strictly uses user\_id filters
when searching but you probably need to take care of suggestions so that
they do not introduce terms from different users to you.
Just my 2 cents.
Regards,
Lukas
On Thu, Feb 10, 2011 at 12:53 AM, Peter Van Dijck
[petervandijck@gmail.com](mailto:petervandijck@gmail.com)wrote:
> Hey Lukáš,
>
> - Hoping for millions of users.
> - The kind of search is faceted search: ie. many objects (say, emails)
> are tagged with tags in different facets. Pretty classic faceted browsing
> approach, which is why we are looking at Solr and now elasticsearch.
> - Search suggestions are nice but not a must have right now.
>
> Peter
>
> On Wed, Feb 9, 2011 at 11:44 AM, Lukáš Vlček [lukas.vlcek@gmail.com](mailto:lukas.vlcek@gmail.com)wrote:
>
> > Hi,
> >
> > How many users do you plan to support?
> > What kind of search do you plan to provide? Do you for example plan to
> > provide some search suggestions while user types in the search terms or
> > spell checking?
> >
> > Regards,
> > Lukas
> >
> > On Wed, Feb 9, 2011 at 1:26 PM, Peter Van Dijck [petervandijck@gmail.com](mailto:petervandijck@gmail.com)wrote:
> >
> > > Hi,
> > > newbie here. I have a question about a usecase. Evaluating using solr vs
> > > elasticsearch.
> > >
> > > The use case is this: we have many users, who each have their own list of
> > > objects they can search. Think Gmail. I should be able to search my own
> > > email, and you should not be able to hack the system to search my email.
> > >
> > > I am hoping we can use elasticsearch's JSON api directly (so we don't
> > > have to create our own json wrapper in between), but I'm not sure how
> > > authentication works. Can I authenticate a user so that they can only search
> > > their own email? Or once I authenticate, they can search the entire email
> > > library of everyone?
> > >
> > > Thanks for any pointers!
> > >
> > > Cheers,
> > > Peter
> > >
> > > --
> > > [http://petervandijck.com/](http://petervandijck.com/)
> > > [http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> > > Skype id: peterkevandijck
> > > USA tel (SkypeIn nr.): (646) 502-8604 \<+16465028604\>
>
> --
> [http://petervandijck.com/](http://petervandijck.com/)
> [http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> Skype id: peterkevandijck
> USA tel (SkypeIn nr.): (646) 502-8604
---
### Author:  [@Peter\_Van\_Dijck](https://discuss.elastic.co/u/Peter_Van_Dijck)
#### Post date: [February 10, 2011, 1:24am UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/9 "2011-02-10T01:24:38Z")
Thanks Lucas, that helps.
Peter
On Wed, Feb 9, 2011 at 8:22 PM, Lukáš Vlček [lukas.vlcek@gmail.com](mailto:lukas.vlcek@gmail.com) wrote:
> Peter,
>
> I think you should check with Shay if Elastic Search can scale to millions
> of indices. (I do not think creating a new index per user is a way to go in
> case of millions users.)
> Which leads me to my other question. You can perfectly store more users
> into one shared index and ensure that the logic strictly uses user\_id
> filters when searching but you probably need to take care of suggestions so
> that they do not introduce terms from different users to you.
>
> Just my 2 cents.
>
> Regards,
> Lukas
>
> On Thu, Feb 10, 2011 at 12:53 AM, Peter Van Dijck \<[petervandijck@gmail.com](mailto:petervandijck@gmail.com)
>
> > wrote:
>
> > Hey Lukáš,
> >
> > - Hoping for millions of users.
> > - The kind of search is faceted search: ie. many objects (say, emails)
> > are tagged with tags in different facets. Pretty classic faceted browsing
> > approach, which is why we are looking at Solr and now elasticsearch.
> > - Search suggestions are nice but not a must have right now.
> >
> > Peter
> >
> > On Wed, Feb 9, 2011 at 11:44 AM, Lukáš Vlček [lukas.vlcek@gmail.com](mailto:lukas.vlcek@gmail.com)wrote:
> >
> > > Hi,
> > >
> > > How many users do you plan to support?
> > > What kind of search do you plan to provide? Do you for example plan to
> > > provide some search suggestions while user types in the search terms or
> > > spell checking?
> > >
> > > Regards,
> > > Lukas
> > >
> > > On Wed, Feb 9, 2011 at 1:26 PM, Peter Van Dijck \<[petervandijck@gmail.com](mailto:petervandijck@gmail.com)
> > >
> > > > wrote:
> > >
> > > > Hi,
> > > > newbie here. I have a question about a usecase. Evaluating using solr vs
> > > > elasticsearch.
> > > >
> > > > The use case is this: we have many users, who each have their own list
> > > > of objects they can search. Think Gmail. I should be able to search my own
> > > > email, and you should not be able to hack the system to search my email.
> > > >
> > > > I am hoping we can use elasticsearch's JSON api directly (so we don't
> > > > have to create our own json wrapper in between), but I'm not sure how
> > > > authentication works. Can I authenticate a user so that they can only search
> > > > their own email? Or once I authenticate, they can search the entire email
> > > > library of everyone?
> > > >
> > > > Thanks for any pointers!
> > > >
> > > > Cheers,
> > > > Peter
> > > >
> > > > --
> > > > [http://petervandijck.com/](http://petervandijck.com/)
> > > > [http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> > > > Skype id: peterkevandijck
> > > > USA tel (SkypeIn nr.): (646) 502-8604 \<+16465028604\>
> >
> > --
> > [http://petervandijck.com/](http://petervandijck.com/)
> > [http://twitter.com/petervandijck](http://twitter.com/petervandijck)
> > Skype id: peterkevandijck
> > USA tel (SkypeIn nr.): (646) 502-8604
--
[http://petervandijck.com/](http://petervandijck.com/)
[http://twitter.com/petervandijck](http://twitter.com/petervandijck)
Skype id: peterkevandijck
USA tel (SkypeIn nr.): (646) 502-8604
---
### Author:  [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)
#### Post date: [February 10, 2011, 10:44am UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/10 "2011-02-10T10:44:21Z")
On Wed, 2011-02-09 at 18:54 -0500, Peter Van Dijck wrote:
> Yes, but then couldn't user X just search for user Y's content if they
> know user Y's userid?
This depends entirely on your interface. Would you open up your
database to receive absolutely any request from outside?
Obviously, no.
Similarly, you want to sanitise any request coming in to Elasticsearch.
You wouldn't just put your ES server on the web. Too easy for somebody
to send a shutdown or delete-index request.
But any query should pass through your front end and apply your
application specific rules.
For instance, you wouldn't want to accept text queries like:
"foo bar user\_id:1234"
But you might want to accept:
"foo bar from:joe"
>
So your query string should be parsed and sanitised before passing that
query on.
clint
---
### Author:  [@Peter\_Van\_Dijck](https://discuss.elastic.co/u/Peter_Van_Dijck)
#### Post date: [February 10, 2011, 11:59am UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/11 "2011-02-10T11:59:10Z")
> But any query should pass through your front end and apply your
> application specific rules.
OK, thanks that helps a lot. This may be blindingly obvious to the more
experienced people, but I was thinking of actually exposing the json rest
api to the world. That's why I was asking about authentication per user.
So we need a pass-through, where we handle auth and such.
Thanks again, if I could upvote this answer I would 🙂
Peter
> For instance, you wouldn't want to accept text queries like:
>
> "foo bar user\_id:1234"
>
> But you might want to accept:
>
> "foo bar from:joe"
>
> >
>
> So your query string should be parsed and sanitised before passing that
> query on.
>
> clint
--
[http://petervandijck.com/](http://petervandijck.com/)
[http://twitter.com/petervandijck](http://twitter.com/petervandijck)
Skype id: peterkevandijck
USA tel (SkypeIn nr.): (646) 502-8604
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:12am UTC](https://discuss.elastic.co/t/question-about-use-case-gmail-like-i-can-only-see-my-own-emails/3903/12 "2017-07-06T04:12:15Z")