# Combine DLS rules from different roles

**URL:** <https://forum.opensearch.org/t/combine-dls-rules-from-different-roles/9575>\
**Category:** Security\
**Tags:** discuss\
**Created:** [May 15, 2022, 10:20pm UTC](https://forum.opensearch.org/t/combine-dls-rules-from-different-roles/9575 "2022-05-15T22:20:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![liamh](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@liamh](https://forum.opensearch.org/u/liamh)\
**Post date:** [May 15, 2022, 10:20pm UTC](https://forum.opensearch.org/t/combine-dls-rules-from-different-roles/9575/1 "2022-05-15T22:20:18Z")

</div>

Hi  
I’ve seen previous questions about combining DLS rules from different roles but none ever seem to have a definitive answer.

I have two roles that have DLS rules/queries and they seem to be OR’d together (I see documents that match either rule). Is there any way at all I can get two ‘restrictive’ DLS rules from different roles to apply at the same time?

Thanks

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 16, 2022, 7:53am UTC](https://forum.opensearch.org/t/combine-dls-rules-from-different-roles/9575/2 "2022-05-16T07:53:16Z")

</div>

@liamh Could you share those queries?

---

<div class="post-metadata">

**Author:** ![liamh](https://avatars.discourse-cdn.com/v4/letter/l/ba8739/32.png) [@liamh](https://forum.opensearch.org/u/liamh)\
**Post date:** [May 16, 2022, 10:04am UTC](https://forum.opensearch.org/t/combine-dls-rules-from-different-roles/9575/3 "2022-05-16T10:04:11Z")

</div>

Hi @pablo

Rules on Role A:

```auto
{
  "bool": {
    "must": {
      "match": {
        "chronology_id": 15
      }
    }
  }
}

```

Rule on Role B:

```auto
{
  "bool": {
    "must": {
      "match": {
        "security_fields.otag_1": 43
      }
    }
  }
}

```

I have also tried Rule A and Rule B as in different forms, like these (for example):

`{"term": { "security_fields.otag_1": { "value": 43 } } }`

and

`{"term": { "security_fields.otag_1": 43 } }`

All of these different rules seem to work in isolation (I always see documents with either security\_fields.otag\_1 = 43 OR chronology\_id = 15 but I want to see only the single document where both security\_fields.otag\_1 = 43 and chronology\_id = 15.

I’ve also tried one role with the term query and the other with the bool query, still get documents where either is true.

Thanks!

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 17, 2022, 9:44am UTC](https://forum.opensearch.org/t/combine-dls-rules-from-different-roles/9575/4 "2022-05-17T09:44:29Z")

</div>

@liamh That would be correct. In my tests, FLS didn’t join and worked as or. Why not create a single role that combines both FLS queries?

```auto
{
  "bool": {
    "must": [
      {
        "match": {
          "chronology_id": 15
        }
      },
      {
        "match": {
          "security_fields.otag_1": 43
        }
      }
    ]
  }
}

```