_ignored field
edit_ignored
field
editThe _ignored
field indexes and stores the names of every field in a document
that has been ignored when the document was indexed. This can, for example,
be the case when the field was malformed and ignore_malformed
was turned on, when a keyword
field’s value exceeds its optional
ignore_above
setting, or when
index.mapping.total_fields.limit
has been reached and
index.mapping.total_fields.ignore_dynamic_beyond_limit
is set to true
.
This field is searchable with term
,
terms
and exists
queries, and is returned as part of the search hits.
For instance the below query matches all documents that have one or more fields that got ignored:
resp = client.search( query={ "exists": { "field": "_ignored" } }, ) print(resp)
response = client.search( body: { query: { exists: { field: '_ignored' } } } ) puts response
const response = await client.search({ query: { exists: { field: "_ignored", }, }, }); console.log(response);
GET _search { "query": { "exists": { "field": "_ignored" } } }
Similarly, the below query finds all documents whose @timestamp
field was
ignored at index time:
resp = client.search( query={ "term": { "_ignored": "@timestamp" } }, ) print(resp)
response = client.search( body: { query: { term: { _ignored: '@timestamp' } } } ) puts response
const response = await client.search({ query: { term: { _ignored: "@timestamp", }, }, }); console.log(response);
GET _search { "query": { "term": { "_ignored": "@timestamp" } } }
Since 8.15.0, the _ignored
field supports aggregations as well.
For example, the below query finds all fields that got ignored:
resp = client.search( aggs={ "ignored_fields": { "terms": { "field": "_ignored" } } }, ) print(resp)
response = client.search( body: { aggregations: { ignored_fields: { terms: { field: '_ignored' } } } } ) puts response
const response = await client.search({ aggs: { ignored_fields: { terms: { field: "_ignored", }, }, }, }); console.log(response);
GET _search { "aggs": { "ignored_fields": { "terms": { "field": "_ignored" } } } }