Can I get a field if I disabled the _source and _all in Elasticsearch

Question

Elasticsearch suggested to dissable _source and _all field in my case, this my mapping

{
  "template": "mq-body-*",
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 0,
    "max_result_window": 100,
    "codec": "best_compression"
  },
  "mappings": {
    "_default_": {
      "_source": {
        "enabled": false
      },
      "_all": {
        "enabled": false
      }
    },
    "body": {
      "properties": {
        "body": {
          "type": "string",
          "doc_values": true,
          "index": "not_analyzed"
        }
      }
    }
  }
}

The body.body is a very large field(20k-300k), we don't have to index and rare get,this is lost-able. But after

PUT /mq-body-local/body/1
{"body":"My body"}

I can't find the body by GET /mq-body-local/body/1?fields=body or POST /mq-body-local/body/_search -d'{"fields":["body"]}',the result is found one but no document.I know there is no _source I can not do get or search, but how can I retrive my document ?

Or Weinberger · Accepted Answer · 2016-01-21 08:12:54Z

5

From Elasticsearch's website:

The _source field contains the original JSON document body that was passed at index time. The _source field itself is not indexed (and thus is not searchable), but it is stored so that it can be returned when executing fetch requests, like get or search

Disabling the source will prevent Elasticsearch from displaying it in the resultset. However, filtering, querying and aggregations will not be affected.

So these two queries will not generate any results in terms of the actual body:

GET mq-body-local/body/_search

GET mq-body-local/body/1

However, you could run this aggregation that will include some of the source, for example:

POST mq-body-local/body/_search

{
  "aggs": {
    "test": {
      "terms": {
        "field": "body"
      }
    }
  }
}

Will produce this result set (I've created some test records):

"aggregations": {
    "test": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "my body",
          "doc_count": 1
        },
        {
          "key": "my body2",
          "doc_count": 1
        }
      ]
    }
  }

answered Jan 21, 2016 at 8:12

Or Weinberger

7,51223 gold badges73 silver badges117 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

wener Over a year ago

Thanks, may I ask how es store these docs ? still store into lucene ? How can I fetch body for a single id (filter?)?

Or Weinberger Over a year ago

Yes documents are stored in Lucene. If you choose to disable _source you cannot get the body field for queries. It seems like you NEED to have the _source enabled.

Collectives™ on Stack Overflow

Can I get a field if I disabled the _source and _all in Elasticsearch

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related