WARNING: Version 2.4 of Elasticsearch has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Object datatype Token count datatype »

› › ›

String datatype

edit

String datatype

edit

Fields of type string accept text values. Strings may be sub-divided into:

Full text

Full text values, like the body of an email, are typically used for text based relevance searches, such as: Find the most relevant documents that match a query for "quick brown fox".

These fields are analyzed, that is they are passed through an analyzer to convert the string into a list of individual terms before being indexed. The analysis process allows Elasticsearch to search for individual words within each full text field. Full text fields are not used for sorting and seldom used for aggregations (although the significant terms aggregation is a notable exception).

Keywords

Keywords are exact values like email addresses, hostnames, status codes, or tags. They are typically used for filtering (Find me all blog posts where status is published), for sorting, and for aggregations. Keyword fields are not_analyzed. Instead, the exact string value is added to the index as a single term.

Below is an example of a mapping for a full text (analyzed) and a keyword (not_analyzed) string field:

PUT my_index
{
  "mappings": {
    "my_type": {
      "properties": {
        "full_name": { 
          "type":  "string"
        },
        "status": {
          "type":  "string", 
          "index": "not_analyzed"
        }
      }
    }
  }
}

	The `full_name` field is an `analyzed` full text field — `index:analyzed` is the default.
	The `status` field is a `not_analyzed` keyword field.

Sometimes it is useful to have both a full text (analyzed) and a keyword (not_analyzed) version of the same field: one for full text search and the other for aggregations and sorting. This can be achieved with multi-fields.

Parameters for string fields

edit

The following parameters are accepted by string fields:

`analyzer`	The analyzer which should be used for `analyzed` string fields, both at index-time and at search-time (unless overridden by the `search_analyzer`). Defaults to the default index analyzer, or the `standard` analyzer.
`boost`	Field-level index time boosting. Accepts a floating point number, defaults to `1.0`.
`doc_values`	Should the field be stored on disk in a column-stride fashion, so that it can later be used for sorting, aggregations, or scripting? Accepts `true` or `false`. Defaults to `true` for `not_analyzed` fields. Analyzed fields do not support doc values.
`fielddata`	Can the field use in-memory fielddata for sorting, aggregations, or scripting? Accepts `{ "format": "disabled" }` or `{ "format": "paged_bytes" }` (default). Not analyzed fields will use doc values in preference to fielddata.
`fields`	Multi-fields allow the same string value to be indexed in multiple ways for different purposes, such as one field for search and a multi-field for sorting and aggregations, or the same string value analyzed by different analyzers.
`ignore_above`	Do not index or analyze any string longer than this value. Defaults to `0` (disabled).
`include_in_all`	Whether or not the field value should be included in the `_all` field? Accepts `true` or `false`. Defaults to `false` if `index` is set to `no`, or if a parent `object` field sets `include_in_all` to `false`. Otherwise defaults to `true`.
`index`	Should the field be searchable? Accepts `analyzed` (default, treat as full-text field), `not_analyzed` (treat as keyword field) and `no`.
`index_options`	What information should be stored in the index, for search and highlighting purposes. Defaults to `positions` for `analyzed` fields, and to `docs` for `not_analyzed` fields.
`norms`	Whether field-length should be taken into account when scoring queries. Defaults depend on the `index` setting: `analyzed` fields default to `{ "enabled": true, "loading": "lazy" }`. `not_analyzed` fields default to `{ "enabled": false }`.
`null_value`	Accepts a string value which is substituted for any explicit `null` values. Defaults to `null`, which means the field is treated as missing. If the field is `analyzed`, the `null_value` will also be analyzed.
`position_increment_gap`	The number of fake term position which should be inserted between each element of an array of strings. Defaults to the `position_increment_gap` configured on the analyzer which defaults to `100`. `100` was chosen because it prevents phrase queries with reasonably large slops (less than 100) from matching terms across field values.
`store`	Whether the field value should be stored and retrievable separately from the `_source` field. Accepts `true` or `false` (default).
`search_analyzer`	The `analyzer` that should be used at search time on `analyzed` fields. Defaults to the `analyzer` setting.
`search_quote_analyzer`	The `analyzer` that should be used at search time when a phrase is encountered. Defaults to the `search_analyzer` setting.
`similarity`	Which scoring algorithm or similarity should be used. Defaults to `default`, which uses TF/IDF.
`term_vector`	Whether term vectors should be stored for an `analyzed` field. Defaults to `no`.

« Object datatype Token count datatype »