Disabling Searching of a Field In Elasticsearch Using Index Templates

Using mappings to define a field as non-searchable in Elasticsearch You may have noticed that Elasticsearch automatically tries to index all of the fields given to it. However, sometimes you will find that you want to just store a field without indexing it.

A short description of mapping

In Elasticsearch, defining settings and mappings that determine how fields should be analysed is done using Index Templates. These templates are automatically applied as new indices are created.

Using mapping we can define how a document, including the fields it contains, are stored and indexed.

Mapping definitions

• Which string fields should be treated as full text fields.
• Which fields contain numbers, dates, or geolocations.
• Whether the values of all fields in the document should be indexed into the catch-all _all field .
• The format of date values.
• Custom rules to control the mapping for dynamically added fields.

A simple example of mapping being specified when creating an index.

Here we are creating an index called my_index with a mapping type called doc. For each field we have specified a type.

PUT my_index 
{
  "mappings": {
    "doc": { 
      "properties": { 
        "title":    { "type": "text"  }, 
        "name":     { "type": "text"  }, 
        "age":      { "type": "integer" }
      }
    }
  }
}

We can see that title will be a text field, name will also be a text field and age will be an integer field. As well as being able to specify the type of the field there are other properties that we can map, one of these is called enabled.

Excluding fields using mapping

In the above example we may want to index the name and age of the person but never have a need to query the title. When set to false, the enabled setting causes Elasticsearch to skip parsing of the contents of a field entirely. In order to do this with our example we would update the title property as follows.

An example of using the enabled property type.

PUT my_index 
{
  "mappings": {
    "doc": { 
      "properties": { 
        "title":    { "enabled": false  }, 
        "name":     { "type": "text"  }, 
        "age":      { "type": "integer" }
      }
    }
  }
}

In the above example the title field is now disabled. Data can still be sent to the title field, the JSON can still be retrieved from the _source field, but it is not searchable or stored in any other way.

The template can be sent to Elasticsearch using the following curl command:

curl -X PUT -H 'Content-Type: application/json' -d '{"mappings": {"doc":{"properties":{"title":{"enabled": false}, "name":{"type": "text"}, "age":{ "type": "integer" }}}}}' https://your-username:your-password@your-endpoint-address/my_index

Your username, password and endpoint address can be found on your Logit Dashboard, just choose settings for the required Stack. Select the Elasticsearch menu and your endpoint is listed in the Elastic Search Access section.

Tip: Index Templates are only applied at Index creation time. This means that changes made to a template later, will have no impact on the existing Index.

We hope that you enjoyed this tutorial, if you want to brush up on your knowledge of Elasticsearch even more then our list of Elasticsearch & ELK interview questions should answer every common query that you may have.

If you enjoyed this article on how to disable the searching of a field in Elasticsearch then why not check out our post on the leading business intelligence tools (including the best in open source BI)?