Making a field hidden in search _source

Elastic Stack Elasticsearch
1

I have a index which has TBs of data now I am adding a new field to it say foo using ingest pipeline

http://localhost:9200/_ingest/pipeline/add
{
    "processors" : [{
        "set": {
            "field" : "foo",
            "value" : 1
        }
    }]
}

http://localhost:9200/idx/_settings
{
    "index" : {
        "default_pipeline" : "add"
    }
}

but I want this field to be not visible when I do _search on that index. Is this possible by setting some mappings ?

http://localhost:9200/idx/_search

The field foo should not be included in the _source field of the response.

Can I set this in an existing index or some other way to achieve the same.

{
    "_source" : {
        "exclude" : "foo"
    }
}
2

Hi @Aditya_Teltia

you can do this two ways:

1 - Exclude field in query search

{
  "_source": {
    "excludes": [ "name" ]
  },
  "query": {
    "match_all": {}
  }
}

2 - Exclude field in mapping

 "mappings": {
    "_source": {
      "excludes": [
        "name"
      ]
    }
3

I am getting this

{
    "error": {
        "root_cause": [
            {
                "type": "resource_already_exists_exception",
                "reason": "index [source/cqGcvkfWTvSF2od8T-llXg] already exists",
                "index_uuid": "cqGcvkfWTvSF2od8T-llXg",
                "index": "source"
            }
        ],
        "type": "resource_already_exists_exception",
        "reason": "index [source/cqGcvkfWTvSF2od8T-llXg] already exists",
        "index_uuid": "cqGcvkfWTvSF2od8T-llXg",
        "index": "source"
    },
    "status": 400
}

Upon doing this

{
    "mappings" : {
        "_source": {
            "excludes": [
                "name"
            ]
        }
    }
}

To cut it down my question is Can we update the mapping of metadata field _source ?

4

It seems not possible to update the _source once the index has been created.

One option is to create a new index and migrate the data from the old one to the new one (you can use the reindex api)

The other option is to use exclude in your search queries.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.