'_source excludes' equivalent on Kibana discover

Elastic Stack Kibana
1

Hi,

I have few very large fields, in order of few MB's. When i query for something on that index i used to get "length of the field crossed max allowed for highlighting". To work around this problem, i started indexing those very long fields with 'index_options: offset' as suggested by error message.

Now i started getting, request time out error (which is currently set to 90000) on Kibana discover tab. All this happening even when i'm not querying that large fields. Although all queries seem to work fine on console ('dev-tools' tab of Kibana)

I'm asking this here because queries to seem to work fine on dev-tools tab of Kibana but not on discover tab.

And is there a way to avoid searching those large fields if I'm not specifically querying those fields in discover tab? In console i can achieve that by

 "_source": {
    "excludes": [
      "field1", "field2", "field3", "field4", "field5"
    ] }

Thanks

2

Yes, you can do this by going to Management > Index Patterns and finding the index pattern that you are querying against in Discover. Then, go to "Source filters" tab and add the fields you'd like to exclude in Discover.

3

Thanks for the response @jen-huang. But then what happens if i query that excluded large field? It'll not return anything because i have excluded it ?

4

If you query in Discover with some_excluded_field:"Some value", you will still get matching results. However the returned documents will not show the excluded field in the immediate results table. (You can still see the full document with excluded field if you click "View single document".)

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.