expose elasticsearch service directly to the client or put it behind a middleware

Question

I write a client server application. I have setup an elastic-search service on the server. The client(iOS app) queries information from the elastic-search service. I have two options:

1. put the elastic-search behind a nginx server(as proxy server). 
2. write an app running on the middle-ware to wrap the elastic-search APIs(only 
   certain APIs that will be queried by the client).

For option 1, all the elastic-search API will be exposed to the client, and to the public at the same-time.

What option should I take? Or there are any other good practice to handle this case?

Answer 1

In my opinion, you should never offer ES-API to the public. By this, everybody could just delete your indexes change your mappings and do whatever they would want to do... This is just plain dangerous.

Furthermore, the mightyness of this API might be too complex for some clients, that just want to perform some basic operations. Altough I don't know your requirements, I would recommend you to wrap ES into your own REST-API, that covers the specific needs of the client.