CODEWITHSUNDEEP
elasticsearch
wener
wener

Reputation: 7770

Can I get a field if I disabled the _source and _all in Elasticsearch

Elasticsearch suggested to dissable _source and _all field in my case, this my mapping

{
  "template": "mq-body-*",
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 0,
    "max_result_window": 100,
    "codec": "best_compression"
  },
  "mappings": {
    "_default_": {
      "_source": {
        "enabled": false
      },
      "_all": {
        "enabled": false
      }
    },
    "body": {
      "properties": {
        "body": {
          "type": "string",
          "doc_values": true,
          "index": "not_analyzed"
        }
      }
    }
  }
}

The body.body is a very large field(20k-300k), we don't have to index and rare get,this is lost-able. But after

PUT /mq-body-local/body/1
{"body":"My body"}

I can't find the body by GET /mq-body-local/body/1?fields=body or POST /mq-body-local/body/_search -d'{"fields":["body"]}',the result is found one but no document.I know there is no _source I can not do get or search, but how can I retrive my document ?

Upvotes: 2

Views: 4504

Answers (1)

Or Weinberger
Or Weinberger

Reputation: 7482

From Elasticsearch's website:

The _source field contains the original JSON document body that was passed at index time. The _source field itself is not indexed (and thus is not searchable), but it is stored so that it can be returned when executing fetch requests, like get or search

Disabling the source will prevent Elasticsearch from displaying it in the resultset. However, filtering, querying and aggregations will not be affected.

So these two queries will not generate any results in terms of the actual body:

GET mq-body-local/body/_search

GET mq-body-local/body/1

However, you could run this aggregation that will include some of the source, for example:

POST mq-body-local/body/_search

{
  "aggs": {
    "test": {
      "terms": {
        "field": "body"
      }
    }
  }
}

Will produce this result set (I've created some test records):

"aggregations": {
    "test": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "my body",
          "doc_count": 1
        },
        {
          "key": "my body2",
          "doc_count": 1
        }
      ]
    }
  }

Upvotes: 5

Related Questions