Index: false on field vs not mapping field at all

Elastic Stack Elasticsearch
1

Hi everyone,

Is there a difference between having a field in my mapping with index: false and simply omitting that field from my mapping (if the mapping has dynamic: false) ?

I'm asking this because I have many fields in my source documents that I don't want to search or aggregate on and looking to optimize for index size and search speed...

Thanks !
B

2

Hello @bern_ash

Setting dynamic: false

  • The field will not be mentioned at all in the mappings (smaller mappings)
  • You "protect" your indices from several unwanted fields
  • The field will still be in the _source
  • Searching for unmapped fields will raise no error.

Setting index: false

  • It still requires to specify a type, so you can validate your data
  • Searching for a mapped field with index: false will raise an exception

You could think of disabling the _source (doc), but it has drawbacks.

Some tips about storage optimizations are available in our doc.