How do you execute a search with more privileges as the current user?

[FritzWittwer]

We often have events in an index for several customers, but each customer should not see the whole index. I'm looking for a mechanism like the s-bit on traditional Linux systems. E.g. a search, which is called from an origin search, which enforces some filtering rules based on the user running the origin search.

Search Term Restrictions are not flexible enough. Another option which comes into my mind is to implement a custom command in Python which searches via the REST API call and enforces the rules.

Are there any other smart ideas out there?

[lakshman239]

One option I had used in the past to restrict 2 diff customers looking at the data from a common index is to define different roles for them along with 'srchFilter' specific to their unique id present in the index/events.

//authorize.conf

[role_cust1]
importRoles = user, ......
srcFilter = index=abc customerId=123

[role_cust2]
srcFilter = index=abc customerId=567