How to don't search for specific fields on Elasticsearch 6.1

To do mapping on Elasticsearch 5.x I use _all enabled => true and for each field which I don't want to look for, I set include_in_all => false. I.e.:

'_all' => array(
	'enabled' => false
),
'properties' => array(
	'relevant_search_field' => array(
		'type' => 'text',
	),
	'value_needed_but_not_searchable' => array(
		'type' => 'text',
		'include_in_all'=> false
	)
)

Now, on Elasticsearch 6.1 _all is not recommended and include_in_all disallowed, so how can I set the fields which I want (or don't want) look for in the search ?

PS: I understand the reason _all is being removed due disk space and other things, and in fact, I don't want to use copy_to too, I just want set the fields to perform the search.

References
Why _all is not good idea
Why _all is not good idea ²
Deprecated on ES 6.x
From where I got the idea to use include_in_all for what I need

You have a few options. It sounds like you've already looked into one of them.

  1. You can set index.query.default_field on the index, which is the closest to the "old behavior" you had: https://www.elastic.co/guide/en/elasticsearch/reference/6.1/query-dsl-query-string-query.html#_default_field
  2. You can pass in the fields as part of your search as you can see on https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html
  3. You can use copy_to as you've seen

1 is probably going to be the easiest, though if you have control over the application that's querying Elasticsearch, you could specify a more exact set of fields at query time which may be better if you don't want to define the same defaults for any app using the index.

Hello Shane,

The first option seems to be exacly what i was looking for. But how can I define multiple fields on it ? I tried:

"mappings": {
  "my_type": {
    "properties": {
      "relevant_search_field_1": {
        "type": "text"
      },
      "relevant_search_field_2": {
        "type": "text"
      }
    }
  }
},
"settings": {
  "index.query.default_field": "relevant_search_field_1, relevant_search_field_2" 
}

and

"settings": {
  "index.query.default_field": [{
  "relevant_search_field_1"
  },
  {
    "relevant_search_field_2"
  }]
}

But those fields are not searchable (seems to not work).

How can I set more than one field to index.query.default_field ?

PS: Some fields I have the same name or more than one type (i.e.: my_type and my_type_2 have the same property name). So, to define may I should specify the object type as well (I.e.: my_type.name) ?

You just need an array of fieldnames there. Here's a short POC showing how to configure it / how it works:

PUT t
{
  "settings": {
    "index.query.default_field": ["relevant_search_field_1","relevant_search_field_2"]
  },
  "mappings": {
    "my_type": {
      "properties": {
        "relevant_search_field_1": {
        "type": "text"
        },
        "relevant_search_field_2": {
          "type": "text"
        },
        "irrelevant_search_field_1": {
          "type": "text"
        },
        "irrelevant_search_field_2": {
          "type": "text"
        }
      }
    }
  }
}

POST /t/my_type
{
  "relevant_search_field_1": "quick",
  "relevant_search_field_2": "brown",
  "irrelevant_search_field_1": "fox",
  "irrelevant_search_field_2": "jumped"
}

Now if you do GET /t/my_type/_search?q=quick or GET /t/my_type/_search?q=brown you'll get the hit and if you do GET /t/my_type/_search?q=fox or GET /t/my_type/_search?q=jumped you'll get 0 hits.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.