Elasticsearch _source

By Opster Team

Updated: Jan 28, 2024

| 1 min read

Overview

When a document is sent for indexing, Elasticsearch indexes all the fields in the format of an inverted index, but it also keeps the original JSON document in a special field called _source. 

Examples

Disabling source field in the index:

PUT /api-logs?pretty
{
  "mappings": {
    "_source": {
      "enabled": false
    }
  }
}

Store only selected fields as a part of _source field:

PUT api-logs
{
  "mappings": {
    "_source": {
      "includes": [
        "*.count",
        "error_info.*"
      ],
      "excludes": [
        "error_info.traceback_message"
      ]
    }
  }
}

Including only selected fields using source filtering:

GET api-logs/_search
{
  "query": {
    "match_all": {}
  },
  "_source": {
       "includes": ["api_name","status_code", "*id"]
  }
}

Notes

The source field brings an overhead of extra storage space but serves special purposes such as:

  • Return as a part of the response when a search query is executed.
  • Used for reindexing purpose, update and update_by_query operations.
  • Used for highlighting, if the field is not stored, it means  the field is not set as “store to true” inside the mapping.
  • Allows selection of fields to be returned.

The only concern with source field is the extra storage usage on disk. But this storage space used by source field can be optimized by changing compression level to best_compression. This setting is done using index.codec parameter.

How helpful was this guide?

We are sorry that this post was not useful for you!

Let us improve this post!

Tell us how we can improve this post?


Related log errors to this ES concept


Could not update watcher stopped status to source
Exception thrown by listener notifying of failure from source
Exception thrown by listener while notifying of cluster state processed from source
Unexpected failure during source
Could not update watcher stopped status to %s source %s
JobId Failed to clear finished time source source
Managed index as part of policy is a shrunk index and the source index does not exist
Close engine failed
Failed to send error back to recovery source
Recovery failed for primary shadow shard failing shard
Recovery failed on shared filesystem
Error during mapping check failing recovery

< Page: 1 of 5 >