Field and document level security in Elasticsearch - Step-by-Step Execution

Concept Flow - Field and document level security

User Request

↓

Check Document Level Security

↓

Check Field Level Security

↓

Return Filtered Data

When a user requests data, Elasticsearch first filters documents based on document level security, then filters fields based on field level security, and finally returns the filtered data.

Execution Sample

Elasticsearch

GET /my-index/_search
{
  "query": { "match_all": {} },
  "_source": ["title", "author"],
  "docvalue_fields": ["publish_date"]
}

This query fetches documents from 'my-index' showing only 'title' and 'author' fields, applying field and document level security filters.

Execution Table

Step	Action	Document Filter Applied	Fields Filter Applied	Result
1	Receive user request	No	No	Full documents and fields requested
2	Apply document level security filter	Yes - only docs user can see	No	Documents filtered to allowed subset
3	Apply field level security filter	Yes	Yes - only allowed fields	Fields filtered to allowed subset
4	Return filtered data	Yes	Yes	User receives only allowed documents and fields

💡 All filters applied; data returned respects user security permissions

Variable Tracker

Variable	Start	After Document Filter	After Field Filter	Final
documents	All documents in index	Subset allowed by doc-level security	Same subset	Subset allowed by doc-level security
fields	All fields requested	All fields requested	Subset allowed by field-level security	Subset allowed by field-level security

Key Moments - 2 Insights

Why do some documents not appear even if they match the query?

Because document level security filters out documents the user is not allowed to see, as shown in step 2 of the execution_table.

Why are some fields missing from the returned documents?

Field level security removes fields the user is not permitted to access, as shown in step 3 of the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, at which step are documents filtered based on user permissions?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Check the 'Document Filter Applied' column in the execution_table.

According to variable_tracker, what happens to the 'fields' variable after field level security is applied?

A It remains all requested fields

B It becomes a subset of allowed fields

C It becomes empty

D It includes extra fields

💡 Hint

Look at the 'fields' row in variable_tracker after 'After Field Filter' column.

If document level security is disabled, how would the execution_table change?

A Step 4 would not return any data

B Step 3 would show 'No' for field filter applied

C Step 2 would show 'No' for document filter applied

D Step 1 would apply field filters

💡 Hint

Document level security is applied at step 2 in the execution_table.

Concept Snapshot

Field and document level security in Elasticsearch:
- Document level security filters which documents a user can see.
- Field level security filters which fields in those documents are visible.
- Both filters apply before data is returned.
- Configured in roles and permissions.
- Ensures users see only allowed data.

Full Transcript

When a user sends a request to Elasticsearch, the system first checks document level security to filter out documents the user is not allowed to see. Then, it applies field level security to hide fields the user cannot access within those documents. Finally, Elasticsearch returns only the allowed documents and fields. This process ensures data privacy and security by controlling access at both document and field levels.