在弹性搜索的开放发行版中创建角色的问题答案

【问题标题】：Problem with creating roles in open-distro for elasticsearch在弹性搜索的开放发行版中创建角色的问题
【发布时间】：2020-08-07 10:54:19
【问题描述】：

我有 2 个角色分配给一个用户。在第一个角色中，我包含具有 _id 1 和 2 的文档的字段名称

{
  "index_permissions": [
    {
      "index_patterns": [
        "test"
      ],
      "dls": "{\n    \"terms\": {\n      \"_id\": [ \"1\", \"2\"] \n    }\n}\n\n",
      "fls": [
        "name"
      ],
      "masked_fields": [],
      "allowed_actions": [
        "get",
        "crud"
      ]
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": [
    "*"
  ]
}

在第二个角色中，我为具有 _id 3 的文档添加字段 job_description

{
  "index_permissions": [
    {
      "index_patterns": [
        "test"
      ],
      "dls": "{\n    \"terms\": {\n      \"_id\": [\"3\"] \n    }\n}\n",
      "fls": [
        "job_description"
      ],
      "masked_fields": [],
      "allowed_actions": []
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": []
}

当我尝试从索引中获取数据时，它会在所有文档中显示 job_description 和 name，

{
  "took" : 237,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : 2.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      }
    ]
  }
}

但我想在两个第一条记录中查看唯一的名称，并且在 3 个这样的文档中只查看 job_description

{
  "took" : 237,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : 2.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 2.0,
        "_source" : {
          "job_description" : "Systems administrator and Linux specialist"
        }
      }
    ]
  }
}

有人知道怎么做吗？

【问题讨论】：

标签： elasticsearch elasticsearch-opendistro

【解决方案1】：

DLS 和 FLS 不能这样协同工作。

DLS 用于仅返回基于 DLS 查询的搜索响应的子集，而 FLS 用于仅在从 elasticsearch 返回的搜索响应中包含或排除某些字段。

对于包含多个此类配置的用户，所有 DLS 查询都被组合（OR 条件），同样所有 FLS 输入都被组合（AND 条件）。

在您的情况下，您有两个 DLS 和两个 FLS 查询。这两个 DLS 查询将用作 OR 条件，在您的情况下，它将返回匹配 1,2 或 3 doc_id 的文档。同样，name 和 job_description 都会返回。

【讨论】：