elasticsearch-readonlyrest-plugin

[![ReadonlyREST](https://img.shields.io/badge/readonlyrest.com-visit-444?style=flat&logo=safari)](https://readonlyrest.com/)
[![Maven Central](https://maven-badges.sml.io/sonatype-central/tech.beshu.ror/audit_2.13/badge.svg)](https://maven-badges.herokuapp.com/maven-central/tech.beshu.ror/audit_2.12)

| Master branch | Develop branch |
|---|---|
| [![CI Master](https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin/actions/workflows/ci.yml?query=branch%3Amaster) | [![CI Develop](https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/sscarduzio/elasticsearch-readonlyrest-plugin/actions/workflows/ci.yml?query=branch%3Adevelop) |

## Supporters 
Thanks **Jeff Saxe** for donating!

[![Patreon](http://i.imgur.com/Fw6Kft4.png)](https://www.patreon.com/readonlyrest) [![Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/sscarduzio/donate) 

---

# Readonly REST Elasticsearch Plugin
Expose the high performance HTTP server embedded in Elasticsearch directly to the public, safely blocking any attempt to delete or modify your data.

In other words... no more proxies! Yay Ponies!
![](http://i.imgur.com/8CLtS1Z.jpg)

## Key Features

#### Tiny memory overhead, blazing fast networking :rocket:
Other security plugins are replacing the high performance, Netty based, embedded REST API of Elasticsearch with Tomcat, Jetty or other cumbersome XML based JEE madness.

This plugin instead is just a lightweight pure-Java filtering layer. Even the SSL layer is provided as an extra Netty transport handler.

#### Fewer moving parts
Some suggest to spin up a new HTTP proxy (Varnish, NGNix, HAProxy) between ES and clients to filter out malicious access with regular expressions on HTTP methods and paths. This is a **bad idea** for two reasons:
- You're introducing more complexity in your architecture.
- Reasoning about security at HTTP level is risky, flaky and less granular than controlling access at the internal Elasticsearch protocol level.

**The only clean way to do the access control is AFTER Elasticsearch has parsed the queries.**

Just set a few rules with this plugin and confidently open it up to the external world.

## All the available rules in detail
* [Official website detailed documentation](https://docs.readonlyrest.com/elasticsearch#rules)

## Contributor License Agreement

By contributing your code to ReadonlyREST you grant its owner Simone Scarduzio a non-exclusive, irrevocable, worldwide, royalty-free, sublicenseable, transferable license under all of Your relevant intellectual property rights (including copyright, patent, and any other rights), to use, copy, prepare derivative works of, distribute and publicly perform and display the Contributions on any licensing terms, including without limitation: (a) open source licenses