I think the issue I missed is needing to escape the quotes at more levels; I did it a bit differently by using json format for query, template, inline, and then a string for the value of inline. I confirmed that the following works on beta1:
$ curl -XPUT -u elastic 'localhost:9200/_xpack/security/role/terms_tojson' -d '{ "indices": [
{
"names": [
"foo"
],
"privileges": [
"read"
],
"query": {
"template": {
"inline": "{\"terms\":{\"acl.groups\": {{#toJson}}_user.metadata.groups{{/toJson}} }}"
}
}
}
]
}'
Enter host password for user 'elastic':
"role":{"created":true}}
$ curl -u elastic 'localhost:9200/_xpack/security/role/terms_tojson'?pretty
Enter host password for user 'elastic':
{
"terms_tojson" : {
"cluster" : [ ],
"indices" : [
{
"names" : [
"foo"
],
"privileges" : [
"read"
],
"query" : "{\"template\":{\"inline\":\"{\\\"terms\\\":{\\\"acl.groups\\\": {{#toJson}}_user.metadata.groups{{/toJson}} }}\"}}"
}
],
"run_as" : [ ],
"metadata" : { }
}
}
$ curl -XPUT 'localhost:9200/foo/t/1' -d '{ "acl": { "groups": [ "a", "c" ] } }' -u elastic
Enter host password for user 'elastic':
{"_index":"foo","_type":"t","_id":"1","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"created":true}
$ curl -XPUT 'localhost:9200/foo/t/2' -d '{ "acl": { "groups": [ "c" ] } }' -u elastic
Enter host password for user 'elastic':
{"_index":"foo","_type":"t","_id":"2","_version":1,"result":"created","_shards":{"total":2,"successful":1,"failed":0},"created":true}
$ curl -u elastic -XPUT 'localhost:9200/_xpack/security/user/tojson' -d '{ "password": "changeme", "roles": [ "terms_tojson" ], "metadata": { "groups": [ "a" ] } }'
Enter host password for user 'elastic':
{"user":{"created":false}}
$ curl -u tojson 'localhost:9200/foo/_search?pretty'
Enter host password for user 'tojson':
{
"took" : 40,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 1,
"max_score" : 1.0,
"hits" : [
{
"_index" : "foo",
"_type" : "t",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"acl" : {
"groups" : [
"a",
"c"
]
}
}
}
]
}
}
$ curl -u elastic 'localhost:9200/foo/_search?pretty'
Enter host password for user 'elastic':
{
"took" : 3,
"timed_out" : false,
"_shards" : {
"total" : 5,
"successful" : 5,
"failed" : 0
},
"hits" : {
"total" : 2,
"max_score" : 1.0,
"hits" : [
{
"_index" : "foo",
"_type" : "t",
"_id" : "2",
"_score" : 1.0,
"_source" : {
"acl" : {
"groups" : [
"c"
]
}
}
},
{
"_index" : "foo",
"_type" : "t",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"acl" : {
"groups" : [
"a",
"c"
]
}
}
}
]
}
}