A possible way to limit users from searching cold or frozen tiers is to setup DLS with a terms query for the _tier field. If an index does not match the requested _tier, rewriting the query to the shard results in a MatchNoDocsQuery, which is handled well by DLS, caching only that the index is unavailable. However, if the role does not contain any other query parts than for the _tier field, the rewrite will result in a MatchAllDocsQuery. There is an optimization for this case too, but it does not kick in until after the query ran populating a bitset of all the documents in the shard. Instead we can optimize this by checking if the rewritten role query becomes MatchAllDocsQuery and use the special match_all bitset directly in this case. This would hopefully nearly eliminate the shard level overhead of having a role query with only a _tier predicate. There is room for further improvements, but we can consider those outside this issue.