ACL example

documents.yaml

_id: 1
acls:
    - accessMap:
        - key: "Role:USER"
          allow:
            - READ
        - key: "Account:52d96bfada0695fcbdb41daf"
          allow:
            - READ
            - UPDATE
---
_id: 2
acls:
    - accessMap:
        - key: "Role:USER"
          allow:
            - READ
        - key: "Account:52d96bfada0695fcbdb41daf"
          deny:
            - READ
            - UPDATE

---
_id: 3
acls:
    - accessMap:
        - key: "Role:USER"
          allow:
            - READ
        - key: "Account:52d96bfada0695fcbdb41daf"
          allow:
            - READ
            - UPDATE

mappings.yaml

type:
    properties: 
        acls: 
            type: nested
            properties: 
                accessMap: 
                    type: nested
                    properties: 
                        allow: 
                            type: string
                            index: not_analyzed
                        deny: 
                            type: string
                            index: not_analyzed

                        key: 
                            type: string
                            index: not_analyzed
                            
                    

play.sh

#!/bin/bash

export ELASTICSEARCH_ENDPOINT="http://localhost:9200"

# Create indexes

curl -XPUT "$ELASTICSEARCH_ENDPOINT/play" -d '{
    "settings": {
        "analysis": {}
    },
    "mappings": {
        "type": {
            "properties": {
                "acls": {
                    "type": "nested",
                    "properties": {
                        "accessMap": {
                            "type": "nested",
                            "properties": {
                                "allow": {
                                    "type": "string",
                                    "index": "not_analyzed"
                                },
                                "deny": {
                                    "type": "string",
                                    "index": "not_analyzed"
                                },
                                "key": {
                                    "type": "string",
                                    "index": "not_analyzed"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}'


# Index documents
curl -XPOST "$ELASTICSEARCH_ENDPOINT/_bulk?refresh=true" -d '
{"index":{"_index":"play","_type":"type","_id":1}}
{"acls":[{"accessMap":[{"key":"Role:USER","allow":["READ"]},{"key":"Account:52d96bfada0695fcbdb41daf","allow":["READ","UPDATE"]}]}]}
{"index":{"_index":"play","_type":"type","_id":2}}
{"acls":[{"accessMap":[{"key":"Role:USER","allow":["READ"]},{"key":"Account:52d96bfada0695fcbdb41daf","deny":["READ","UPDATE"]}]}]}
{"index":{"_index":"play","_type":"type","_id":3}}
{"acls":[{"accessMap":[{"key":"Role:USER","allow":["READ"]},{"key":"Account:52d96bfada0695fcbdb41daf","allow":["READ","UPDATE"]}]}]}
'

# Do searches

curl -XPOST "$ELASTICSEARCH_ENDPOINT/_search?pretty" -d '
{
    "query": {
        "filtered": {
            "filter": {
                "nested": {
                    "path": "acls",
                    "filter": {
                        "bool": {
                            "must": {
                                "nested": {
                                    "path": "acls.accessMap",
                                    "filter": {
                                        "bool": {
                                            "must": [
                                                {
                                                    "term": {
                                                        "allow": "READ"
                                                    }
                                                },
                                                {
                                                    "terms": {
                                                        "key": [
                                                            "Role:USER",
                                                            "Account:52d96bfada0695fcbdb41daf"
                                                        ]
                                                    }
                                                }
                                            ]
                                        }
                                    }
                                }
                            },
                            "must_not": {
                                "nested": {
                                    "path": "acls.accessMap",
                                    "filter": {
                                        "bool": {
                                            "must": [
                                                {
                                                    "term": {
                                                        "deny": "READ"
                                                    }
                                                },
                                                {
                                                    "terms": {
                                                        "key": [
                                                            "Role:USER",
                                                            "Account:52d96bfada0695fcbdb41daf"
                                                        ]
                                                    }
                                                }
                                            ]
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
'

play.yaml

# Auto generated by Found's Play-tool at 2014-01-23T18:13:22+01:00
version: 0
title: "Two-level nested filtering"
description: ACL example

searches.yaml

# In reply to http://stackoverflow.com/questions/21314037/elasticsearch-filter-on-deeply-nested-data

query:
    filtered: 
        filter: 
            nested: 
                path: acls
                filter:

                    bool:
                        must:
                            nested: 
                                path: acls.accessMap
                                filter:
                                    bool:
                                        must:
                                            - term:
                                                 allow: READ
                                            - terms:
                                                 key: ["Role:USER", "Account:52d96bfada0695fcbdb41daf"]
                        must_not:
                            nested: 
                                path: acls.accessMap
                                filter:
                                    bool:
                                        must:
                                            - term:
                                                 deny: READ
                                            - terms:
                                                 key: ["Role:USER", "Account:52d96bfada0695fcbdb41daf"]