Field-level security

The easiest way to get started with document- and field-level security is open OpenSearch Dashboards and choose Security. Then choose Roles, create a new role, and review the Index permissions section.

You have two options when you configure field-level security: include or exclude fields. If you include fields, users see only those fields when they retrieve a document. For example, if you include the , title, and year fields, a search result might look like this:

If you exclude fields, users see everything but those fields when they retrieve a document. For example, if you exclude those same fields, the same search result might look like this:

You can specify field-level security settings using OpenSearch Dashboards, roles.yml, and the REST API.

• To exclude fields in roles.yml or the REST API, add ~ before the field name.

1. Choose a role and Add index permission.
2. Choose an index pattern.
3. Under Field level security, use the drop-down to select your preferred option. Then specify one or more fields and press Enter.

If you map a user to multiple roles, we recommend that those roles use either include or exclude statements for each index. The security plugin evaluates field-level security settings using the operator, so combining include and exclude statements can lead to neither behavior working properly.

For example, in the movies index, if you include actors, title, and year in one role, exclude actors, title, and genres in another role, and then map both roles to the same user, a search result might look like this:

Document-level security relies on OpenSearch queries, which means that all fields in the query must be visible in order for it to work properly. If you use field-level security in conjunction with document-level security, make sure you don’t restrict access to the fields that document-level security uses.