Users of Elastic may configure role-based security for specific indexed fields or indexed documents. For document-level security, a query filter(s) is associated with a role, and an authenticated search query provides the role. The search engine looks up RBAC rules for the given role and index combination, adds the filter or filters defined for the role and adds the filters as part of a compound search query. This allows an easy form of document-level RBAC so certain roles may search and access only a given set of documents based on one or more filter query fragments.

https://www.elastic.co/guide/en/elasticsearch/reference/current/document-level-security.html