Understanding Document Level Security (DLS) Performance

Howdy all,

Trying to understand how lucene-level DLS filters are handled. When a query is run, does it search over all of the data in index then apply a global filter after, or does it only query the relevant segments?

e.g. I have an index with a field called ‘team’, and that can be either ‘yellow’ or ‘blue’, when a person with DLS for only ‘blue’ runs a query, does it search all documents for all teams, or just for their ‘blue’ team? If this is the case is there an impact on ingestion performance splitting up lucene segments like this?

Thanks for your help in understanding,

Hi @BlaiseSaunders,

You have some control over the behaviour (there are three available modes for you to choose from), please see here :