In addition to reading this guide, we recommend you run the Elasticsearch Health Check-Up. It will detect issues and improve your Elasticsearch performance by analyzing your shard sizes, threadpools, memory, snapshots, disk watermarks and more.The Elasticsearch Check-Up is free and requires no installation.
To evaluate your use of OpenSearch source, we recommend you try AutoOps for OpenSearch. AutoOps will also help you optimize other important settings and processes in OpenSearch to improve performance and ensure high availability for your crucial data.
You can also try running the free OpenSearch Error Check-Up which analyzes 2 JSON files to detect errors.
Overview
When a document is sent for indexing, OpenSearch indexes all the fields in the format of an inverted index, but it also keeps the original JSON document in a special field called _source.
Examples
Disabling source field in the index:
PUT /api-logs?pretty
{
"mappings": {
"_source": {
"enabled": false
}
}
}Store only selected fields as a part of _source field:
PUT api-logs
{
"mappings": {
"_source": {
"includes": [
"*.count",
"error_info.*"
],
"excludes": [
"error_info.traceback_message"
]
}
}
}Including only selected fields using source filtering:
GET api-logs/_search
{
"query": {
"match_all": {}
},
"_source": {
"includes": ["api_name","status_code", "*id"]
}
}Notes
The source field brings an overhead of extra storage space but serves special purposes such as:
- Return as a part of the response when a search query is executed.
- Used for reindexing purpose, update and update_by_query operations.
- Used for highlighting, if the field is not stored, it means the field is not set as “store to true” inside the mapping.
- Allows selection of fields to be returned.
The only concern with source field is the extra storage usage on disk. But this storage space used by source field can be optimized by changing compression level to best_compression. This setting is done using index.codec parameter.
