Where is Elasticsearch storing unmapped field

Elastic Stack Elasticsearch
1

I have an index created with index.mode=logsdb and index.mapping.source.mode=synthetic. The mapping also has dynamic: false.

If I index a document containing an unmapped field, for example:

{
  "@timestamp": "2026-07-23T15:30:45Z",
  "latency": 15,
  "foo": "bar"
}

the foo field is:

  • not added to the mapping (as expected),
  • not searchable,
  • not returned by the fields API,
  • but it is still present in _source.

My question is: where is Elasticsearch storing this unmapped field?

Since synthetic _source is generally described as being reconstructed from doc_values and stored fields, I'm trying to understand what happens in this case. foo has no mapping, so it shouldn't have doc values or an inverted index, yet it is still available in _source.

2

Hi @ddoroshenko Ahhh I remembering wondering this myself a while ago.

Run

POST <my-index>/_disk_usage?run_expensive_tasks=true

So Elasticsearch keeps the unmapped content separately for _source reconstruction. Internally, these fields are stored special _ignore_source storage used by synthetic source for data that cannot be reconstructed purely from mapped field structures.

It does not call out specifically each field.

Curious if you are just curious :slight_smile: ... or seeing an issue

Also to be clear you will only Actually get synthetic source if you have a license.

3

Hi @stephenb Thanks for the helpful answer!

We're evaluating whether unmapped (non-indexed) fields will still be visible in Kibana when using synthetic _source. This question came up while investigating that behavior.

4

Assuming that you are seeing them in Discover etc...

What version are you on?

To validate you are actually using Synth Source

GET <my-index>/_settings?include_defaults=true&flat_settings=true

Look for

...
   "index.mapping.pattern_text.disable_templating": "false",
      "index.mapping.semantic_text.use_legacy_format": "false",
      "index.mapping.source.mode": "SYNTHETIC",  <<< THIS
      "index.mapping.synthetic_id": "false",
      "index.mapping.synthetic_source.skip_ignored_source_read": "false",
...
```
5

I'm on 9.4.x.

I created the index manually via Dev Tools, so as I mentioned in my original post, synthetic _source is definitely enabled. :slightly_smiling_face:

6

Just because you enable synthetic in the settings does not mean it's actually taking effect... It requires a commercial enterprise license or trial license.

If the cluster had a basic or platinum license and set it, it will accept the setting yeah but it will not actually take effect

This is why I suggest running the above command to validate it.

Just being clear in case of anyone else reads this.