3 ms·
You have always been able to use the query DSL to write queries, aggregations, etc. If you're referring to scripting then yes, in 5.0 the "Painless" scripting l
by nemo44x 9y ago
You have always been able to use the query DSL to write queries, aggregations, etc. If you're referring to scripting then yes, in 5.0 the "Painless" scripting language was introduced which allows you to send scripted queries via API request without having to store them on the server. The language was designed to not allow for exploits like when using other languages for running scripts on Elasticsearch.
- naiv 9y agoI meant querying the index from the frontend directly.
- nemo44x 9y agoAs in a publicly facing front end? If that's your case, you wouldn't ever want to expose Elasticsearch to your front end directly. If you have a private front end that is inside your firewall then just create HTTP requests to Elasticsearch - it has a RESTful API. But querying from a publicly facing front end would be a poor idea - would you expose a database directly to the front end?
- naiv 9y agoIt is called Elasticsearch and not Elasticdatabase, at one point it sounded like good idea to jump on the nosql bandwagon. It is a fantastic idea to call the index directly from the frontend and could be solved with a read only type of index or api key with read only scope. The current design with an unnecessary security layer outside of Elasticsearch is a poor idea adding too much administrative overhead and ridiculous latency.
- loopdoend 9y agoThey have what you are looking for with their X-Pack Security addition, which requires a license, though under very favourable terms compared to others...
- notyourwork 9y agoHamburgers also don't have ham, you are missing the point.
- spencera 9y agoI suggest checking out cloud.elastic.co if you want a way to securely query Elasticsearch directly from the browser without getting X-Pack