_source field
The _source field contains the original JSON document body that was passed at index time. The_source field itself is not indexed (and thus is not searchable), but it is stored so that it can be returned when executing fetch requests, like or .
Disabling the _source field
Though very handy to have around, the source field does incur storage overhead within the index. For this reason, it can be disabled as follows:
PUT tweets{ "mappings": { "tweet": { "_source": { "enabled": false } } } } 
Think before disabling the _source field
Users often disable the _source field without thinking about the consequences, and then live to regret it. If the _source field isn’t available then a number of features are not supported:
- The , , and APIs.
- On the fly .
- The ability to reindex from one Elasticsearch index to another, either to change mappings or analysis, or to upgrade an index to a new major version.
- The ability to debug queries or aggregations by viewing the original document used at index time.
- Potentially in the future, the ability to repair index corruption automatically.
If disk space is a concern, rather increase the instead of disabling the _source.
Including / Excluding fields from _source
An expert-only feature is the ability to prune the contents of the _source field after the document has been indexed, but before the _source field is stored.
Removing fields from the _source has similar downsides to disabling _source, especially the fact that you cannot reindex documents from one Elasticsearch index to another. Consider using instead.
The includes/excludes parameters (which also accept wildcards) can be used as follows:
PUT logs{ "mappings": { "event": { "_source": { "includes": [ "*.count", "meta.*" ], "excludes": [ "meta.description", "meta.other.*" ] } } } } PUT logs/event/1 { "requests": { "count": 10, "foo": "bar" }, "meta": { "name": "Some metric", "description": "Some metric description", "other": { "foo": "one", "baz": "two" } } } GET logs/event/_search { "query": { "match": { "meta.other.foo": "one" } } } |
| These fields will be removed from the stored |
| We can still search on this field, even though it is not in the stored |