How to don't search for specific fields on Elasticsearch 6.1

Elastic Stack Elasticsearch
1

To do mapping on Elasticsearch 5.x I use _all enabled => true and for each field which I don't want to look for, I set include_in_all => false. I.e.:

'_all' => array(
	'enabled' => false
),
'properties' => array(
	'relevant_search_field' => array(
		'type' => 'text',
	),
	'value_needed_but_not_searchable' => array(
		'type' => 'text',
		'include_in_all'=> false
	)
)

Now, on Elasticsearch 6.1 _all is not recommended and include_in_all disallowed, so how can I set the fields which I want (or don't want) look for in the search ?

PS: I understand the reason _all is being removed due disk space and other things, and in fact, I don't want to use copy_to too, I just want set the fields to perform the search.

References
Why _all is not good idea
Why _all is not good idea ²
Deprecated on ES 6.x
From where I got the idea to use include_in_all for what I need

2

You have a few options. It sounds like you've already looked into one of them.

  1. You can set index.query.default_field on the index, which is the closest to the "old behavior" you had: https://www.elastic.co/guide/en/elasticsearch/reference/6.1/query-dsl-query-string-query.html#_default_field
  2. You can pass in the fields as part of your search as you can see on https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html
  3. You can use copy_to as you've seen

1 is probably going to be the easiest, though if you have control over the application that's querying Elasticsearch, you could specify a more exact set of fields at query time which may be better if you don't want to define the same defaults for any app using the index.

3

Hello Shane,

The first option seems to be exacly what i was looking for. But how can I define multiple fields on it ? I tried:

"mappings": {
  "my_type": {
    "properties": {
      "relevant_search_field_1": {
        "type": "text"
      },
      "relevant_search_field_2": {
        "type": "text"
      }
    }
  }
},
"settings": {
  "index.query.default_field": "relevant_search_field_1, relevant_search_field_2" 
}

and

"settings": {
  "index.query.default_field": [{
  "relevant_search_field_1"
  },
  {
    "relevant_search_field_2"
  }]
}

But those fields are not searchable (seems to not work).

How can I set more than one field to index.query.default_field ?

PS: Some fields I have the same name or more than one type (i.e.: my_type and my_type_2 have the same property name). So, to define may I should specify the object type as well (I.e.: my_type.name) ?

4

You just need an array of fieldnames there. Here's a short POC showing how to configure it / how it works:

PUT t
{
  "settings": {
    "index.query.default_field": ["relevant_search_field_1","relevant_search_field_2"]
  },
  "mappings": {
    "my_type": {
      "properties": {
        "relevant_search_field_1": {
        "type": "text"
        },
        "relevant_search_field_2": {
          "type": "text"
        },
        "irrelevant_search_field_1": {
          "type": "text"
        },
        "irrelevant_search_field_2": {
          "type": "text"
        }
      }
    }
  }
}

POST /t/my_type
{
  "relevant_search_field_1": "quick",
  "relevant_search_field_2": "brown",
  "irrelevant_search_field_1": "fox",
  "irrelevant_search_field_2": "jumped"
}

Now if you do GET /t/my_type/_search?q=quick or GET /t/my_type/_search?q=brown you'll get the hit and if you do GET /t/my_type/_search?q=fox or GET /t/my_type/_search?q=jumped you'll get 0 hits.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.