[jrgnsd]

Setting up nginx to proxy to Elasticsearch with HTTP auth on top is fairly trivial. There's a couple of good articles on the web if you google for it. Also, should you have an Elasticsearch support contract, you get access to the Shield plugin which has extensive access control.

But yes, the fact that it is open OOTB is frustrating.

[pyre]

This is exactly what I do, but the fact that it's wide open and relies on you to use a different (and de-coupled) service for permissions was surprising to me (at the time).