It is called Elasticsearch and not Elasticdatabase, at one point it sounded like good idea to jump on the nosql bandwagon.
It is a fantastic idea to call the index directly from the frontend and could be solved with a read only type of index or api key with read only scope.
The current design with an unnecessary security layer outside of Elasticsearch is a poor idea adding too much administrative overhead and ridiculous latency.
They have what you are looking for with their X-Pack Security addition, which requires a license, though under very favourable terms compared to others...
Re:Elasticsearch 6.0.0 GA released
by notyourwork on Tuesday November 14, 2017 @08:54PM
(#15700908)
Hamburgers also don't have ham, you are missing the point.
But querying from a publicly facing front end would be a poor idea - would you expose a database directly to the front end?