I meant querying the index from the frontend directly.
But querying from a publicly facing front end would be a poor idea - would you expose a database directly to the front end?
It is a fantastic idea to call the index directly from the frontend and could be solved with a read only type of index or api key with read only scope.
The current design with an unnecessary security layer outside of Elasticsearch is a poor idea adding too much administrative overhead and ridiculous latency.