Blacklisting(restricting) fields from elasticsearch query to be search

Elastic Stack Elasticsearch
1

Hi, friends am new to Elasticsearch. I want to know if I can exclude certain fields from search from Elasticsearch. To elaborate I want to ignore it from my search. It should not search that field when we specify but should be searchable on all the fields other than those fields.

In the below data I want to achieve2 things:-

  • I want to search for Product ABC in all other fields other than 'Service_Sold' attribute.

  • I want to restrict particular fields of some attributes to be not searchable like i want to restrict Elasticsearch to not search in this field 'Service_Sold.Type'

I came across excludes and whitelisting methods which is not feasible as we have lots of fields in index and would increase the complexity of the query.

Our requirement can be changed at any time which means whatever field we don't want to be searchable now, later we can make it searchable and for that, we don't want to reindex data again and again on Elasticsearch, as we have a large amount of data. So that's why we need to index the whole data.

Would appreciate any suggestions and help.

Note 7.10 version elastic-seach running queries on KIBANA. We can also upgrade our verison if required.

Here is the sample document.

{
        "_index" : "_dev",
        "_type" : "_doc",
        "_id" : "data-2",
        "_score" : 1.0,
        "_source" : {
          "type" : "datas",
          "id_number" : 736762732784934,
          "date" : "2011-01-26",
          "Service_Sold" : [
            {
              "Type" : "Type XYZ",
              "Product_Name" : "Product ABC"
            }
          ],
          "Product_Sold" : [
            {
              "Type" : "Type XYZ",
              "Product_Name" : "Product ABC"
            }
          ]
          ...
          50 other attributes
        }
 }
2

Welcome to our community! :smiley:

If you don't want it to be searched, why send it to Elasticsearch?

3

Hey @warkolm Thanks for reply, Actually our requirement can be changed at any time which means whatever field we don't want to be searchable now, later we can make it searchable and for that, we don't want to reindex data again and again as we have a large amount of data. So that's why we need to index the whole data.

4

Then you should look at document and field security - Document level security | Elasticsearch Guide [8.3] | Elastic and Field level security | Elasticsearch Guide [8.3] | Elastic

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.