# X-Pack Document Level Security issue

**URL:** <https://discuss.elastic.co/t/x-pack-document-level-security-issue/183788>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 31, 2019, 7:42pm UTC](https://discuss.elastic.co/t/x-pack-document-level-security-issue/183788 "2019-05-31T19:42:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aharon](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@Aharon](https://discuss.elastic.co/u/Aharon)\
**Post date:** [May 31, 2019, 7:43pm UTC](https://discuss.elastic.co/t/x-pack-document-level-security-issue/183788/1 "2019-05-31T19:43:00Z")

</div>

We are using ElasticSearch 6.5.4 and recently implemented Document Level security on all indexes (prior to this we were using our own internal custom developed solution). Since going live we see increased utilization of "Fixed Bitsets" on all indexes, to the point of heap exhaustion if we do not periodically (like twice a day) clear the request cache. This issue did not occur prior to implementing document level filtering. Any thoughts?

---

<div class="post-metadata">

**Author:** ![jpcarey](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jpcarey/32/46668_2.png) [@jpcarey](https://discuss.elastic.co/u/jpcarey)\
**Post date:** [June 1, 2019, 3:56pm UTC](https://discuss.elastic.co/t/x-pack-document-level-security-issue/183788/2 "2019-06-01T15:56:42Z")

</div>

How many nodes & JVM heap size? How many documents do you have in these indices? How many unique roles are using different document level security queries?

The fixed bitsets are used to keep a cache of authorized documents for a given role (you can have different roles, but if they map to the same underlying query for the document level security - this would only be one).

---

<div class="post-metadata">

**Author:** ![theY4Kman](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/they4kman/32/47281_2.png) [@theY4Kman](https://discuss.elastic.co/u/theY4Kman)\
**Post date:** [June 1, 2019, 5:44pm UTC](https://discuss.elastic.co/t/x-pack-document-level-security-issue/183788/3 "2019-06-01T17:44:34Z")

</div>

We have a couple dozen nodes, most with 32G heap. The indices often reach single-digit billions of docs. There's only one role using document-level security, which reads from the user's metadata to enforce access.

Though there's only one role, I wonder whether the user's metadata gets included as part of the key when caching FixedBitSets – i.e. does each user with differing metadata (and thus differing rendered document-level security queries) get its own distinct FixedBitSet?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2019, 5:44pm UTC](https://discuss.elastic.co/t/x-pack-document-level-security-issue/183788/4 "2019-06-29T17:44:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.