{"id":31674977,"url":"https://github.com/brehldev/opensearch-filter-proxy","last_synced_at":"2026-05-15T22:05:10.449Z","repository":{"id":314624169,"uuid":"1056203200","full_name":"brehldev/opensearch-filter-proxy","owner":"brehldev","description":"Rust proxy for OpenSearch that automatically applies global security filters to search queries. Acts as a transparent proxy to ensure restricted data is never exposed.","archived":false,"fork":false,"pushed_at":"2025-09-30T05:15:27.000Z","size":86,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-09-30T07:11:29.356Z","etag":null,"topics":["axum","elasticsearch","opensearch","rust","security"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/brehldev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-09-13T15:50:00.000Z","updated_at":"2025-09-21T13:59:32.000Z","dependencies_parsed_at":"2025-09-13T17:52:47.222Z","dependency_job_id":"cdaa0976-2584-4568-b01f-20e2fc89d47d","html_url":"https://github.com/brehldev/opensearch-filter-proxy","commit_stats":null,"previous_names":["brehldev/opensearch-filter-proxy"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/brehldev/opensearch-filter-proxy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brehldev%2Fopensearch-filter-proxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brehldev%2Fopensearch-filter-proxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brehldev%2Fopensearch-filter-proxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brehldev%2Fopensearch-filter-proxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/brehldev","download_url":"https://codeload.github.com/brehldev/opensearch-filter-proxy/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brehldev%2Fopensearch-filter-proxy/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278891747,"owners_count":26063856,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-08T02:00:06.501Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["axum","elasticsearch","opensearch","rust","security"],"created_at":"2025-10-08T04:58:24.409Z","updated_at":"2025-10-08T04:58:26.799Z","avatar_url":"https://github.com/brehldev.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Opensearch Filter Proxy \n\nOpenSearch Filter Proxy is a lightweight proxy server that automatically applies global filters to OpenSearch queries.\n\nIt works by intercepting requests to an OpenSearch instance, injecting predefined filters into the query, and forwarding the modified request to the OpenSearch server. These filters can be used to enforce data access rules based on user roles, permissions, or other criteria.\n\nThis tool is especially useful when the OpenSearch security plugin isn’t sufficient—for example, when more complex filtering is required than what JWT roles can provide. \n\n⚠️ Keep in mind: the effectiveness of this proxy depends entirely on the filters you configure.\n\n## Installation\n\nYou can launch the project, with opensearch using docker compose\n\n```bash\ndocker compose up -d\n```\n### Adding Sample Data\nTo load sample data into your OpenSearch instance:\n\n```bash\ncd ./data \n\ncurl -X POST \"http://localhost:9200/_bulk\" \\\n  -H \"Content-Type: application/x-ndjson\" \\\n  --data-binary \"@bulk.ndjson\"\n\n```\n\n## Environment Variables\n\nThe proxy can be configured using the following environment variables:\n\n| Variable                         | Default                | Description                                                                |\n|----------------------------------|------------------------|----------------------------------------------------------------------------|\n| `OPENSEARCH_URL`                 | `http://localhost:9200` | Base URL of the OpenSearch server (used internally by the proxy).          |\n| `RUST_LOG`                       | `info`                  | Log level for the proxy (`error`, `warn`, `info`, `debug`, `trace`).       |\n\n\n## Supported Endpoints\n\nThe following section describes the [OpenSearch API](https://docs.opensearch.org/latest/api-reference/) endpoints supported by the proxy.\nThe proxy uses a deny-all approach, meaning only explicitly allowed endpoints are accessible.\n\n\nThe proxy currently supports the following OpenSearch endpoints:\n\n- `/{index}/_search` - POST\n- `/{index}/_msearch` - POST\n- `/_cluster/health` - GET\n\n## Benchmark\n\nYou can use `hey` to benchmark the proxy server. First, [install](https://github.com/rakyll/hey) `hey` if you haven't already:\n\nRunning the benchmark:\n\n```bash\nhey -m POST \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"query\": {\"match_all\": {}}}' \\\n  http://localhost:3000/movies/_search\n```\n\nResults:\n\n```bash\nSummary:\n  Total:\t0.0651 secs\n  Slowest:\t0.0421 secs\n  Fastest:\t0.0013 secs\n  Average:\t0.0147 secs\n  Requests/sec:\t3071.3120\n  \n  Total data:\t55800 bytes\n  Size/request:\t279 bytes\n\nResponse time histogram:\n  0.001 [1]\t    |■\n  0.005 [11]\t|■■■■■■■■\n  0.009 [40]\t|■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■\n  0.014 [52]\t|■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■\n  0.018 [32]\t|■■■■■■■■■■■■■■■■■■■■■■■■■\n  0.022 [32]\t|■■■■■■■■■■■■■■■■■■■■■■■■■\n  0.026 [5]\t    |■■■■\n  0.030 [22]\t|■■■■■■■■■■■■■■■■■\n  0.034 [3]\t    |■■\n  0.038 [0]\t    |\n  0.042 [2]\t    |■■\n\n\nLatency distribution:\n  10% in 0.0067 secs\n  25% in 0.0091 secs\n  50% in 0.0128 secs\n  75% in 0.0191 secs\n  90% in 0.0268 secs\n  95% in 0.0288 secs\n  99% in 0.0394 secs\n\nDetails (average, fastest, slowest):\n  DNS+dialup:\t0.0010 secs, 0.0013 secs, 0.0421 secs\n  DNS-lookup:\t0.0003 secs, 0.0000 secs, 0.0020 secs\n  req write:\t0.0000 secs, 0.0000 secs, 0.0005 secs\n  resp wait:\t0.0137 secs, 0.0012 secs, 0.0372 secs\n  resp read:\t0.0000 secs, 0.0000 secs, 0.0001 secs\n\nStatus code distribution:\n  [200]\t200 responses\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrehldev%2Fopensearch-filter-proxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbrehldev%2Fopensearch-filter-proxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrehldev%2Fopensearch-filter-proxy/lists"}