在 elasticsearch 的开放发行版中创建角色的问题

Question

我有 2 个角色分配给一个用户。 在第一个角色中，我包含具有 _id 1 和 2 的文档的字段名称

{
  "index_permissions": [
    {
      "index_patterns": [
        "test"
      ],
      "dls": "{\n    \"terms\": {\n      \"_id\": [ \"1\", \"2\"] \n    }\n}\n\n",
      "fls": [
        "name"
      ],
      "masked_fields": [],
      "allowed_actions": [
        "get",
        "crud"
      ]
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": [
    "*"
  ]
}

在第二个角色中，我为具有 _id 3 的文档包含字段 job_description

{
  "index_permissions": [
    {
      "index_patterns": [
        "test"
      ],
      "dls": "{\n    \"terms\": {\n      \"_id\": [\"3\"] \n    }\n}\n",
      "fls": [
        "job_description"
      ],
      "masked_fields": [],
      "allowed_actions": []
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": []
}

当我尝试从索引中获取数据时，它会在所有文档中显示 job_description 和 name，

{
  "took" : 237,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : 2.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      }
    ]
  }
}

但我想在两个第一条记录中看到唯一的名字，在 3 个这样的文档中只有 job_description

{
  "took" : 237,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : 2.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 2.0,
        "_source" : {
          "job_description" : "Systems administrator and Linux specialist"
        }
      }
    ]
  }
}

有人知道怎么做吗？

Answer 1

DLS 和 FLS 不能这样协同工作。

DLS 用于仅根据 DLS 查询返回搜索响应的子集，而 FLS 用于仅在从 elasticsearch 返回的搜索响应中包含或排除某些字段。

对于包含多个此类配置的用户，所有 DLS 查询都被组合（OR 条件），并且类似地，所有 FLS 输入都被组合（AND 条件）。

在您的情况下，您有两个 DLS 和两个 FLS 查询。 这两个 DLS 查询将用作 OR 条件，在您的情况下，它将返回匹配 1,2 或 3 doc_id 的文档。 同样， name 和 job_description 都将返回。