{"action":"created","issue":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/107","repository_url":"https://api.github.com/repos/floragunncom/search-guard","labels_url":"https://api.github.com/repos/floragunncom/search-guard/issues/107/labels{/name}","comments_url":"https://api.github.com/repos/floragunncom/search-guard/issues/107/comments","events_url":"https://api.github.com/repos/floragunncom/search-guard/issues/107/events","html_url":"https://github.com/floragunncom/search-guard/issues/107","id":141230880,"number":107,"title":"Filter on field type","user":{"login":"rbw0","id":1263192,"avatar_url":"https://avatars.githubusercontent.com/u/1263192?v=3","gravatar_id":"","url":"https://api.github.com/users/rbw0","html_url":"https://github.com/rbw0","followers_url":"https://api.github.com/users/rbw0/followers","following_url":"https://api.github.com/users/rbw0/following{/other_user}","gists_url":"https://api.github.com/users/rbw0/gists{/gist_id}","starred_url":"https://api.github.com/users/rbw0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rbw0/subscriptions","organizations_url":"https://api.github.com/users/rbw0/orgs","repos_url":"https://api.github.com/users/rbw0/repos","events_url":"https://api.github.com/users/rbw0/events{/privacy}","received_events_url":"https://api.github.com/users/rbw0/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-16T10:28:02Z","updated_at":"2016-05-01T13:03:01Z","closed_at":"2016-05-01T13:03:01Z","body":"Hello,\r\n\r\nFirstly - thanks for a great project.\r\n\r\nWe're currently running a single node ES cluster (ELK stack). It's a pretty much default setup with all logs ending up in the same index. Indices are created once per day (i.e. logstash-2016.03.16).\r\n\r\nAll events are created with a `type` field, which makes it easy creating and saving searches in the Kibana GUI (which interfaces with ES for querying).\r\n\r\nIs it possible with Search Guard to limit what a user can see based on a certain field value (I.e. allow a user to see the record if field `type` equals a certain value)? Is this what flsfilter is? If possible, what would such an ACL configuration look like?\r\n\r\nThanks!\r\n\r\nRobert\r\n"},"comment":{"url":"https://api.github.com/repos/floragunncom/search-guard/issues/comments/216040739","html_url":"https://github.com/floragunncom/search-guard/issues/107#issuecomment-216040739","issue_url":"https://api.github.com/repos/floragunncom/search-guard/issues/107","id":216040739,"user":{"login":"floragunncom","id":11678154,"avatar_url":"https://avatars.githubusercontent.com/u/11678154?v=3","gravatar_id":"","url":"https://api.github.com/users/floragunncom","html_url":"https://github.com/floragunncom","followers_url":"https://api.github.com/users/floragunncom/followers","following_url":"https://api.github.com/users/floragunncom/following{/other_user}","gists_url":"https://api.github.com/users/floragunncom/gists{/gist_id}","starred_url":"https://api.github.com/users/floragunncom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/floragunncom/subscriptions","organizations_url":"https://api.github.com/users/floragunncom/orgs","repos_url":"https://api.github.com/users/floragunncom/repos","events_url":"https://api.github.com/users/floragunncom/events{/privacy}","received_events_url":"https://api.github.com/users/floragunncom/received_events","type":"User","site_admin":false},"created_at":"2016-05-01T13:03:01Z","updated_at":"2016-05-01T13:03:01Z","body":"Its possible with Search Guard 2, with the upcoming document and field level security (DLS/FLS), see https://github.com/floragunncom/search-guard/wiki\r\n\r\nIf you need filter for only for ``_type``  you can achieve this also without DLS/FLS"}}