It is called Elasticsearch and not Elasticdatabase, at one point it sounded like good idea to jump on the nosql bandwagon.

It is a fantastic idea to call the index directly from the frontend and could be solved with a read only type of index or api key with read only scope.

The current design with an unnecessary security layer outside of Elasticsearch is a poor idea adding too much administrative overhead and ridiculous latency.