在 elasticsearch 的開放發行版中創建角色的問題

Question

我有 2 個角色分配給一個用戶。 在第一個角色中，我包含具有 _id 1 和 2 的文檔的字段名稱

{
  "index_permissions": [
    {
      "index_patterns": [
        "test"
      ],
      "dls": "{\n    \"terms\": {\n      \"_id\": [ \"1\", \"2\"] \n    }\n}\n\n",
      "fls": [
        "name"
      ],
      "masked_fields": [],
      "allowed_actions": [
        "get",
        "crud"
      ]
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": [
    "*"
  ]
}

在第二個角色中，我為具有 _id 3 的文檔包含字段 job_description

{
  "index_permissions": [
    {
      "index_patterns": [
        "test"
      ],
      "dls": "{\n    \"terms\": {\n      \"_id\": [\"3\"] \n    }\n}\n",
      "fls": [
        "job_description"
      ],
      "masked_fields": [],
      "allowed_actions": []
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": []
}

當我嘗試從索引中獲取數據時，它會在所有文檔中顯示 job_description 和 name，

{
  "took" : 237,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : 2.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      }
    ]
  }
}

但我想在兩個第一條記錄中看到唯一的名字，在 3 個這樣的文檔中只有 job_description

{
  "took" : 237,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : 2.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 2.0,
        "_source" : {
          "job_description" : "Systems administrator and Linux specialist"
        }
      }
    ]
  }
}

有人知道怎么做嗎？

Answer 1

DLS 和 FLS 不能這樣協同工作。

DLS 用於僅根據 DLS 查詢返回搜索響應的子集，而 FLS 用於僅在從 elasticsearch 返回的搜索響應中包含或排除某些字段。

對於包含多個此類配置的用戶，所有 DLS 查詢都被組合（OR 條件），並且類似地，所有 FLS 輸入都被組合（AND 條件）。

在您的情況下，您有兩個 DLS 和兩個 FLS 查詢。 這兩個 DLS 查詢將用作 OR 條件，在您的情況下，它將返回匹配 1,2 或 3 doc_id 的文檔。 同樣， name 和 job_description 都將返回。