Searching non-indexed fields

Elastic Stack Elasticsearch
1

Hi everyone,

Contrary to popular opinion, I'm able to search non-indexed fields in Elasticsearch. I'm wondering if this is is a bug or a newly introduced feature. I'm on Elasticsearch 8.6.2.

The documentation says "Fields that are not indexed are typically not queryable". Does it mean Elasticsearch will decide at query-time whether to allow a non-indexed field to be queried or not?

I create below an index with one field which is not indexed:

$ curl -X PUT "localhost:9200/test?pretty" -H 'Content-Type: application/json' -d'
{
  "settings": {
    "number_of_shards": 1
  },
  "mappings": {
    "properties": {
      "field1": { "type": "keyword", "index": false }
    }
  }
}
'

{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "test"
}

I then write one document

$ curl -X POST "localhost:9200/test/_doc/?pretty" -H 'Content-Type: application/json' -d'
{
    "field1": "elastic"
}'

{
  "_index" : "test",
  "_id" : "nVJ_tYYB_ZjVXqJjQjyB",
  "_version" : 1,
  "result" : "created",
  "_shards" : {
    "total" : 2,
    "successful" : 1,
    "failed" : 0
  },
  "_seq_no" : 0,
  "_primary_term" : 1
}

Then I search for that document:

$ curl -X POST -H 'Content-Type: application/json' --data '{"query":{"bool":{"must":[{"match":{"field1":"elastic"}}]}}}' localhost:9200/test/_search
{"took":1,"timed_out":false,"_shards":{"total":1,"successful":1,"skipped":0,"failed":0},"hits":{"total":{"value":1,"relation":"eq"},"max_score":1.0,"hits":[{"_index":"test","_id":"nVJ_tYYB_ZjVXqJjQjyB","_score":1.0,"_source":
{
    "field1": "elastic"
}}]}}%

Thank you

2

Found it.
Looks like this is an "expensive query" that is enabled by default, but can be disabled.

"queries on numeric, date, boolean, ip, geo_point or keyword fields that are not indexed but have doc values enabled"

Since 8.1 What’s new in 8.1 | Elasticsearch Guide [8.1] | Elastic

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.