[DOCS] Documented rest.action.multi.allow_explicit_index

docs/reference/api-conventions.asciidoc

@@ -121,3 +121,19 @@ For libraries that don't accept a request body for non-POST requests,
 you can pass the request body as the `source` query string parameter
 instead.
 
+[[url-access-control]]
+== URL-based access control
+
+Many users use a proxy with URL-based access control to secure access to
+Elasticsearch indices. For <<search-multi-search,multi-search>>, <<docs-multi-
+get,multi-get>> and <<docs-bulk,bulk>> requests, the user has the choice of
+specifying an index in the URL and on each individual request within the
+request body. This can make URL-based access control challenging.
+
+To prevent the user from overriding the index which has been specified in the
+URL, add this setting to the `config.yml` file:
+
+    rest.action.multi.allow_explicit_index: false
+
+The default value is `true`, but when set to `false`, Elasticsearch will
+reject requests that have an explicit index specified in the request body.

docs/reference/docs/bulk.asciidoc

@@ -153,7 +153,7 @@ to expire. Setting it to `true` can trigger additional load, and may
 slow down indexing.
 
 [float]
-[[update]]
+[[bulk-update]]
 === Update
 
 When using `update` action `_retry_on_conflict` can be used as field in
@@ -174,3 +174,9 @@ the options. Curl example with update actions:
 { "update" : {"_id" : "2", "_type" : "type1", "_index" : "index1", "_retry_on_conflict" : 3} }
 { "doc" : {"field" : "value"}, "doc_as_upsert" : true }
 --------------------------------------------------
+
+[float]
+[[bulk-security]]
+=== Security
+
+See <<url-access-control>>

docs/reference/docs/multi-get.asciidoc

@@ -168,3 +168,9 @@ curl 'localhost:9200/_mget?routing=key1' -d '{
 
 In this example, document `test/type/2` will be fetch from shard corresponding to routing key `key1` but
 document `test/type/1` will be fetch from shard corresponding to routing key `key2`.
+
+[float]
+[[mget-security]]
+=== Security
+
+See <<url-access-control>>

docs/reference/search/multi-search.asciidoc

@@ -70,3 +70,9 @@ against the `test2` index.
 
 The `search_type` can be set in a similar manner to globally apply to
 all search requests.
+
+[float]
+[[msearch-security]]
+=== Security
+
+See <<url-access-control>>