mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-06 21:18:31 +00:00
36a3b84fc9
* Default include_type_name to false for get and put mappings. * Default include_type_name to false for get field mappings. * Add a constant for the default include_type_name value. * Default include_type_name to false for get and put index templates. * Default include_type_name to false for create index. * Update create index calls in REST documentation to use include_type_name=true. * Some minor clean-ups around the get index API. * In REST tests, use include_type_name=true by default for index creation. * Make sure to use 'expression == false'. * Clarify the different IndexTemplateMetaData toXContent methods. * Fix FullClusterRestartIT#testSnapshotRestore. * Fix the ml_anomalies_default_mappings test. * Fix GetFieldMappingsResponseTests and GetIndexTemplateResponseTests. We make sure to specify include_type_name=true during xContent parsing, so we continue to test the legacy typed responses. XContent generation for the typeless responses is currently only covered by REST tests, but we will be adding unit test coverage for these as we implement each typeless API in the Java HLRC. This commit also refactors GetMappingsResponse to follow the same appraoch as the other mappings-related responses, where we read include_type_name out of the xContent params, instead of creating a second toXContent method. This gives better consistency in the response parsing code. * Fix more REST tests. * Improve some wording in the create index documentation. * Add a note about types removal in the create index docs. * Fix SmokeTestMonitoringWithSecurityIT#testHTTPExporterWithSSL. * Make sure to mention include_type_name in the REST docs for affected APIs. * Make sure to use 'expression == false' in FullClusterRestartIT. * Mention include_type_name in the REST templates docs.
135 lines
3.8 KiB
Plaintext
135 lines
3.8 KiB
Plaintext
[[mapping-source-field]]
|
|
=== `_source` field
|
|
|
|
The `_source` field contains the original JSON document body that was passed
|
|
at index time. The `_source` field itself is not indexed (and thus is not
|
|
searchable), but it is stored so that it can be returned when executing
|
|
_fetch_ requests, like <<docs-get,get>> or <<search-search,search>>.
|
|
|
|
==== Disabling the `_source` field
|
|
|
|
Though very handy to have around, the source field does incur storage overhead
|
|
within the index. For this reason, it can be disabled as follows:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
PUT tweets?include_type_name=true
|
|
{
|
|
"mappings": {
|
|
"_doc": {
|
|
"_source": {
|
|
"enabled": false
|
|
}
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
|
|
[WARNING]
|
|
.Think before disabling the `_source` field
|
|
==================================================
|
|
|
|
Users often disable the `_source` field without thinking about the
|
|
consequences, and then live to regret it. If the `_source` field isn't
|
|
available then a number of features are not supported:
|
|
|
|
* The <<docs-update,`update`>>, <<docs-update-by-query,`update_by_query`>>,
|
|
and <<docs-reindex,`reindex`>> APIs.
|
|
|
|
* On the fly <<search-request-highlighting,highlighting>>.
|
|
|
|
* The ability to reindex from one Elasticsearch index to another, either
|
|
to change mappings or analysis, or to upgrade an index to a new major
|
|
version.
|
|
|
|
* The ability to debug queries or aggregations by viewing the original
|
|
document used at index time.
|
|
|
|
* Potentially in the future, the ability to repair index corruption
|
|
automatically.
|
|
==================================================
|
|
|
|
TIP: If disk space is a concern, rather increase the
|
|
<<index-codec,compression level>> instead of disabling the `_source`.
|
|
|
|
.The metrics use case
|
|
**************************************************
|
|
|
|
The _metrics_ use case is distinct from other time-based or logging use cases
|
|
in that there are many small documents which consist only of numbers, dates,
|
|
or keywords. There are no updates, no highlighting requests, and the data
|
|
ages quickly so there is no need to reindex. Search requests typically use
|
|
simple queries to filter the dataset by date or tags, and the results are
|
|
returned as aggregations.
|
|
|
|
In this case, disabling the `_source` field will save space and reduce I/O.
|
|
|
|
**************************************************
|
|
|
|
|
|
[[include-exclude]]
|
|
==== Including / Excluding fields from `_source`
|
|
|
|
An expert-only feature is the ability to prune the contents of the `_source`
|
|
field after the document has been indexed, but before the `_source` field is
|
|
stored.
|
|
|
|
WARNING: Removing fields from the `_source` has similar downsides to disabling
|
|
`_source`, especially the fact that you cannot reindex documents from one
|
|
Elasticsearch index to another. Consider using
|
|
<<search-request-source-filtering,source filtering>> instead.
|
|
|
|
The `includes`/`excludes` parameters (which also accept wildcards) can be used
|
|
as follows:
|
|
|
|
[source,js]
|
|
--------------------------------------------------
|
|
PUT logs?include_type_name=true
|
|
{
|
|
"mappings": {
|
|
"_doc": {
|
|
"_source": {
|
|
"includes": [
|
|
"*.count",
|
|
"meta.*"
|
|
],
|
|
"excludes": [
|
|
"meta.description",
|
|
"meta.other.*"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
PUT logs/_doc/1
|
|
{
|
|
"requests": {
|
|
"count": 10,
|
|
"foo": "bar" <1>
|
|
},
|
|
"meta": {
|
|
"name": "Some metric",
|
|
"description": "Some metric description", <1>
|
|
"other": {
|
|
"foo": "one", <1>
|
|
"baz": "two" <1>
|
|
}
|
|
}
|
|
}
|
|
|
|
GET logs/_search
|
|
{
|
|
"query": {
|
|
"match": {
|
|
"meta.other.foo": "one" <2>
|
|
}
|
|
}
|
|
}
|
|
--------------------------------------------------
|
|
// CONSOLE
|
|
|
|
<1> These fields will be removed from the stored `_source` field.
|
|
<2> We can still search on this field, even though it is not in the stored `_source`.
|