new to elasticsearch here, I have this case...

I have a lot of client using the same cluster, so assuming we have something like this:

{
   // data
   "customer_id": "xxx"
}

if there a way to guarantee that only customers with that id can access the doc by default and not rely on the query?

I wonder if something along the lines of, setting the customer_id as metadata and creating a security policy where I pass the customer id in the request header (and match this metadata value) exists in es?

CodePudding user response：

https://www.elastic.co/guide/en/elasticsearch/reference/8.0/field-and-document-access-control.html is definitely the approach to take here