documents.yaml

_type: document
_id: 1
title: Doc 1
---
_parent: 1
_type: acl

acls:
    - accessMap:
        - key: "Role:USER"
          allow:
            - READ
        - key: "Account:52d96bfada0695fcbdb41daf"
          allow:
            - READ
            - UPDATE
---
_type: document
_id: 2
title: Doc 2

---
_type: acl
_parent: 2
acls:
    - accessMap:
        - key: "Role:USER"
          allow:
            - READ
        - key: "Account:52d96bfada0695fcbdb41daf"
          deny:
            - READ
            - UPDATE

mappings.yaml

acl: 
    _parent: 
        type: document

    properties: 
        acls: 
            properties:                    
                accessMap:
                    type: nested
                    properties: 
                        key:
                            type: string
                            index: not_analyzed
                        allow:
                            type: string
                            index: not_analyzed
                        deny:
                            type: string
                            index: not_analyzed
                            

play.sh

#!/bin/bash

export ELASTICSEARCH_ENDPOINT="http://localhost:9200"

# Create indexes

curl -XPUT "$ELASTICSEARCH_ENDPOINT/play" -d '{
    "settings": {
        "analysis": {}
    },
    "mappings": {
        "acl": {
            "_parent": {
                "type": "document"
            },
            "properties": {
                "acls": {
                    "properties": {
                        "accessMap": {
                            "type": "nested",
                            "properties": {
                                "key": {
                                    "type": "string",
                                    "index": "not_analyzed"
                                },
                                "allow": {
                                    "type": "string",
                                    "index": "not_analyzed"
                                },
                                "deny": {
                                    "type": "string",
                                    "index": "not_analyzed"
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}'


# Index documents
curl -XPOST "$ELASTICSEARCH_ENDPOINT/_bulk?refresh=true" -d '
{"index":{"_index":"play","_type":"document","_id":1}}
{"title":"Doc 1"}
{"index":{"_index":"play","_type":"acl","_parent":1}}
{"acls":[{"accessMap":[{"key":"Role:USER","allow":["READ"]},{"key":"Account:52d96bfada0695fcbdb41daf","allow":["READ","UPDATE"]}]}]}
{"index":{"_index":"play","_type":"document","_id":2}}
{"title":"Doc 2"}
{"index":{"_index":"play","_type":"acl","_parent":2}}
{"acls":[{"accessMap":[{"key":"Role:USER","allow":["READ"]},{"key":"Account:52d96bfada0695fcbdb41daf","deny":["READ","UPDATE"]}]}]}
'

# Do searches

curl -XPOST "$ELASTICSEARCH_ENDPOINT/_search?pretty" -d '
{
    "query": {
        "filtered": {
            "filter": {
                "has_child": {
                    "type": "acl",
                    "filter": {
                        "bool": {
                            "must": [
                                {
                                    "nested": {
                                        "path": "acls.accessMap",
                                        "filter": {
                                            "bool": {
                                                "must": [
                                                    {
                                                        "terms": {
                                                            "key": [
                                                                "Role:USER",
                                                                "Account:52d96bfada0695fcbdb41daf"
                                                            ]
                                                        }
                                                    },
                                                    {
                                                        "term": {
                                                            "allow": "READ"
                                                        }
                                                    }
                                                ]
                                            }
                                        }
                                    }
                                }
                            ],
                            "must_not": [
                                {
                                    "nested": {
                                        "path": "acls.accessMap",
                                        "filter": {
                                            "bool": {
                                                "must": [
                                                    {
                                                        "terms": {
                                                            "key": [
                                                                "Role:USER",
                                                                "Account:52d96bfada0695fcbdb41daf"
                                                            ]
                                                        }
                                                    },
                                                    {
                                                        "term": {
                                                            "deny": "READ"
                                                        }
                                                    }
                                                ]
                                            }
                                        }
                                    }
                                }
                            ]
                        }
                    }
                }
            }
        }
    }
}
'

play.yaml

# Auto generated by Found's Play-tool at 2014-01-23T22:09:01+01:00
version: 0
title: "doc with child-docs with nested ACLs"
description: ""

searches.yaml

# In reply to http://stackoverflow.com/questions/21314037/elasticsearch-filter-on-deeply-nested-data

query: 
    filtered: 
        filter: 
            has_child: 
                type: acl
                filter: 
                    bool: 
                        must: 
                            - nested:
                                path: acls.accessMap
                                filter:
                                    bool:
                                        must:
                                            - terms:
                                                key: ["Role:USER", "Account:52d96bfada0695fcbdb41daf"]
                                            - term:
                                                allow: READ
                        must_not: 
                            - nested:
                                path: acls.accessMap
                                filter:
                                    bool:
                                        must:
                                            - terms:
                                                key: ["Role:USER", "Account:52d96bfada0695fcbdb41daf"]
                                            - term:
                                                deny: READ