WARNING: Version 1.7 of Elasticsearch has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
_source
edit_source
editThe _source
field is an automatically generated field that stores the actual
JSON that was used as the indexed document. It is not indexed (searchable),
just stored. When executing "fetch" requests, like get or
search, the _source
field is returned by default.
Disabling source
editThough very handy to have around, the source field does incur storage overhead within the index. For this reason, it can be disabled as follows:
PUT tweets { "mappings": { "tweet": { "_source": { "enabled": false } } } }
Think before disabling the source field
Users often disable the _source
field without thinking about the
consequences, and then live to regret it. If the _source
field isn’t
available then a number of features are not supported:
-
The
update
API. - On the fly highlighting.
- The ability to reindex from one Elasticsearch index to another, either to change mappings or analysis, or to upgrade an index to a new major version.
- The ability to debug queries or aggregations by viewing the original document used at index time.
- Potentially in the future, the ability to repair index corruption automatically.
Including / Excluding fields from source
editAn expert-only feature is the ability to prune the contents of the _source
field after the document has been indexed, but before the _source
field is
stored. The includes
/excludes
parameters (which also accept wildcards)
can be used as follows:
PUT logs { "mappings": { "event": { "_source": { "includes": [ "*.count", "meta.*" ], "excludes": [ "meta.description", "meta.other.*" ] } } } } PUT logs/event/1 { "requests": { "count": 10, "foo": "bar" }, "meta": { "name": "Some metric", "description": "Some metric description", "other": { "foo": "one", "baz": "two" } } } GET logs/event/_search { "query": { "match": { "meta.other.foo": "one" } } }
These fields will be removed from the stored |
|
We can still search on this field, even though it is not in the stored |
Removing fields from the _source
has similar downsides to disabling
_source
, especially the fact that you cannot reindex documents from one
Elasticsearch index to another. Consider using
source filtering or a
transform script instead.