Excluding all fields from object property except for one (4096 byte limit error for large URI)

Elastic Stack Elasticsearch
1

Hi,

I'm trying to get ES to return me only currency in the example below in a concise way.

The currency field: hits.hits._source.attributes.currency

For the sake of the example I also have properties like this:

hits.hits._source.attributes.a
hits.hits._source.attributes.b
hits.hits._source.attributes.c
hits.hits._source.attributes.d
hits.hits._source.attributes.e

Right now I'm doing this in the URI:

(I'm doing a wild card to reduce the text size but it feels like a hack)

transactions/_search?filter_path=_scroll_id,hits.hits._source,-*.*.*.*.e,-*.*.*.*.d,-*.*.*.*.c,-*.*.*.*.b,-*.*.*.*.a&scroll=1m&size=10

I'd like to know if they're is a more concise way to do this so I don't keep hitting the 4096 byte limit for the URI. I feel like there must be a more concise way to exclude everything without going through the list one at a time:

Any help would be appreciated!

2

Hi @Akaash_Mukherjee

Did you try with _source options?

3

This is great! Didn't know about this, I'm new to ES. I'm guessing that this will allow me to no longer hit that character limit for the URI. I'm still not sure though how in my case I could exclude all properties on my attribute property concisely and not listing all the individual exclusions.

4

Maybe this works:

  "_source": {
    "includes": ["attributes.currency"],
    "excludes": ["attributes.a", "attributes.b", "attributes.c"]
  }
5

Yeah this is more or less what I'm doing, I would just have liked a way to write exclude everything except currency instead of having to list exclude a,b,c

GET transactions/_search?filter_path=_scroll_id,hits.hits._source&scroll=1m&size=10
{
  "_source": {
    "excludes": [ "attributes.a", "attributes.b", "attributes.c", "attributes.d", "attributes.e"]
  },
  "query": {
    "bool": {
      "filter": [
        {"term": {"elastic_tag_subdomain": "some_company"}},
        {"term": {"elastic_tag_module": "order"}},
        {"term": {"attributes.order_category": "Regular"}}
      ]
    }
  }
}
6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.