Searching non-indexed fields

Hi everyone,

Contrary to popular opinion, I'm able to search non-indexed fields in Elasticsearch. I'm wondering if this is is a bug or a newly introduced feature. I'm on Elasticsearch 8.6.2.

The documentation says "Fields that are not indexed are typically not queryable". Does it mean Elasticsearch will decide at query-time whether to allow a non-indexed field to be queried or not?

I create below an index with one field which is not indexed:

$ curl -X PUT "localhost:9200/test?pretty" -H 'Content-Type: application/json' -d'
  "settings": {
    "number_of_shards": 1
  "mappings": {
    "properties": {
      "field1": { "type": "keyword", "index": false }

  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "test"

I then write one document

$ curl -X POST "localhost:9200/test/_doc/?pretty" -H 'Content-Type: application/json' -d'
    "field1": "elastic"

  "_index" : "test",
  "_id" : "nVJ_tYYB_ZjVXqJjQjyB",
  "_version" : 1,
  "result" : "created",
  "_shards" : {
    "total" : 2,
    "successful" : 1,
    "failed" : 0
  "_seq_no" : 0,
  "_primary_term" : 1

Then I search for that document:

$ curl -X POST -H 'Content-Type: application/json' --data '{"query":{"bool":{"must":[{"match":{"field1":"elastic"}}]}}}' localhost:9200/test/_search
    "field1": "elastic"

Thank you

Found it.
Looks like this is an "expensive query" that is enabled by default, but can be disabled.

"queries on numeric, date, boolean, ip, geo_point or keyword fields that are not indexed but have doc values enabled"

Since 8.1 What’s new in 8.1 | Elasticsearch Guide [8.1] | Elastic

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.