diff --git a/_security-plugin/access-control/document-level-security.md b/_security-plugin/access-control/document-level-security.md index 210c2d29..6d062d03 100644 --- a/_security-plugin/access-control/document-level-security.md +++ b/_security-plugin/access-control/document-level-security.md @@ -124,11 +124,11 @@ PUT _plugins/_security/api/roles/abac }] } ``` -## Use term-level lookup queries (TLQs) with DLS +## Use term-level lookup queries with DLS -You can perform term-level lookup queries (TLQs) with document-level security (DLS) using either of two modes: adaptive or filter level. The default mode is adaptive, where OpenSearch automatically switches between Lucene-level or filter-level mode depending on whether or not there is a TLQ. DLS queries without TLQs are executed in Lucene-level mode, whereas DLS queries with TLQs are executed in filter-level mode. +You can perform term-level queries with document-level security (DLS) using either of two modes: adaptive or filter level. The default mode is adaptive, where OpenSearch automatically switches between Lucene-level or filter-level mode depending on whether or not there is a term-level query. DLS queries that do not contain a term-level query are executed in Lucene-level mode, whereas DLS queries with term-level queries are executed in filter-level mode. -By default, the security plugin detects if a DLS query contains a TLQ or not and chooses the appropriate mode automatically at runtime. +By default, the security plugin detects if a DLS query contains a term-level query or not and chooses the appropriate mode automatically at runtime. To learn more about OpenSearch queries, see [Term-level queries](https://opensearch.org/docs/latest/opensearch/query-dsl/term/). @@ -144,6 +144,6 @@ plugins.security.dls.mode: filter-level | Evaluation mode | Parameter | Description | Usage | :--- | :--- | :--- | :--- | -Lucene-level DLS | `lucene-level` | This setting makes all DLS queries apply to the Lucene level. | Lucene-level DLS modifies Lucene queries and data structures directly. This is the most efficient mode but does not allow certain advanced constructs in DLS queries, including TLQs. +Lucene-level DLS | `lucene-level` | This setting makes all DLS queries apply to the Lucene level. | Lucene-level DLS modifies Lucene queries and data structures directly. This is the most efficient mode but does not allow certain advanced constructs in DLS queries, including term-level queries. Filter-level DLS | `filter-level` | This setting makes all DLS queries apply to the filter level. | In this mode, OpenSearch applies DLS by modifying queries that OpenSearch receives. This allows for term-level lookup queries in DLS queries, but you can only use the `get`, `search`, `mget`, and `msearch` operations to retrieve data from the protected index. Additionally, cross-cluster searches are limited with this mode. -Adaptive | `adaptive-level` | The default setting that allows OpenSearch to automatically choose the mode. | DLS queries without TLQs are executed in Lucene-level mode, while DLS queries that contain TLQ are executed in filter- level mode. +Adaptive | `adaptive-level` | The default setting that allows OpenSearch to automatically choose the mode. | DLS queries without term-level queries are executed in Lucene-level mode, while DLS queries that contain a term-level query are executed in filter-level mode.