Field rule not working when exceeding a certain no of docs

Hello @coutoPL , problem was fixed for the match_all, however there is a very strange problem happening now.

I have an index where i’ve made a rule for fields, that for some user, he cannot view the contents of that field - ~input_raw for example.
This index contains a field df_date where date is stored like 2023-02-21T11:47:22.992000

After that, i’m trying from the Dev Tools in kibana, with that user i’m executing the following code:

GET /discovery-pseudo-dataset/_search
{
  "query": {
    "match": {
      "input_raw": "12345678"
    }
  }
}

It doesn’t return anything which is ok.
However, if i’m trying the same query using the following python libraries:

elasticsearch==7.12.1
install elasticsearch-dsl==7.4.0
install elasticsearch-service
install urllib3==1.26.2

and i’m executing the following code

import elasticsearch_dsl, elasticsearch
from ssl import create_default_context, CERT_NONE
from elasticsearch_service import ElasticsearchService
context = create_default_context()
context.check_hostname = False
context.verify_mode = CERT_NONE
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

extra = {'scheme':'https','http_auth_username':'account','http_auth_password':'password', 'ssl_context': context}

es=ElasticsearchService('es-cluster.com', '443', **extra)

q = elasticsearch_dsl.Q("range", **{"df_date": {"gte": "2023-02-20", "lte": "2023-02-22"}})

returned_data = es.get_documents_with_q('dataset', query=q)

returned_data['input_raw']

returned_data

that input_raw field is displayed.