The _source field contains the original JSON document body of an Elaticsearch document. It is not indexed nor searchable, but it can be returned when executing fetch requests.

Keeping the _source field saved with the document comes with substantial storage overhead. Disabling the _source field is easy and does come with consequences. Think carefully before disabling it. Disabling it will also disable these features.

  • The update, update_by_query and reindex APIs.
  • On the fly highlighting.
  • The ability to reindex from one Elasticsearch index to another, either to change mappings or analysis, or to upgrade an index to a new major version.
  • The ability to debug queries or aggregations by viewing the original document used at index time.
  • Potentially in the future, the ability to repair index corruption automatically.

Disabling the _source field can be done using an Index Template.

Tagged on: