Disover without _source field?

Elastic Stack Kibana
1

Is it possible to fully use the section Discover in Kibana with disabled _source?
I disabled this field and set option:
Read fields from _source (discover:searchFieldsFromSource) - False
However, I still get the error in Discover:
Unable to retrieve the requested [fields] since _source is disabled in the mappings for index [index]

image_2022-07-15_18-31-35
image_2022-07-15_18-31-35941×972 48.4 KB

If I return this field and make a rollout, then everything works fine, including those documents that were received when the field was disabled.

ELK stack 7.17.5

2

have you also removed the _source field from the Meta Fields setting in Advanced Settings?

3

Yes, problem still exist.

Request:

{
  "track_total_hits": false,
  "sort": [
    {
      "@timestamp": {
        "order": "desc",
        "unmapped_type": "boolean"
      }
    }
  ],
  "fields": [
    {
      "field": "*",
      "include_unmapped": "true"
    },
    {
      "field": "@timestamp",
      "format": "strict_date_optional_time"
    }
  ],
  "size": 1000,
  "version": true,
  "script_fields": {},
  "stored_fields": [
    "*"
  ],
  "runtime_mappings": {},
  "_source": false,
  "query": {
    "bool": {
      "must": [],
      "filter": [
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2022-08-15T12:11:41.275Z",
              "lte": "2022-08-15T12:26:41.275Z"
            }
          }
        }
      ],
      "should": [],
      "must_not": []
    }
  }
}

Response:

{
  "took": 959,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 4,
    "skipped": 4,
    "failed": 1,
    "failures": [
      {
        "shard": 0,
        "index": "skk_test-000018",
        "node": "5hbz3oOzRXG-BJO7_ebmZQ",
        "reason": {
          "type": "illegal_argument_exception",
          "reason": "Unable to retrieve the requested [fields] since _source is disabled in the mappings for index [skk_test-000018]"
        }
      }
    ]
  },
  "hits": {
    "max_score": null,
    "hits": []
  }
}
4

Based on this issue it looks like you have to update to 8.3.1 at least:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.