elasticsearch - 如果我在 Elasticsearch 中禁用 _source 和 _all，我可以获得一个字段吗

Question

Elasticsearch suggested在我的例子中禁用 _source 和 _all 字段，这是我的映射

{
  "template": "mq-body-*",
  "settings": {
    "number_of_shards": 3,
    "number_of_replicas": 0,
    "max_result_window": 100,
    "codec": "best_compression"
  },
  "mappings": {
    "_default_": {
      "_source": {
        "enabled": false
      },
      "_all": {
        "enabled": false
      }
    },
    "body": {
      "properties": {
        "body": {
          "type": "string",
          "doc_values": true,
          "index": "not_analyzed"
        }
      }
    }
  }
}

body.body是一个非常大的字段(20k-300k)，我们不必索引并且很少获得，这是可能丢失的。但之后

PUT /mq-body-local/body/1
{"body":"My body"}

我无法通过 GET/mq-body-local/body/1?fields=body 或 POST/mq-body-local/body/_search -d 找到正文'{"fields":["body"]}'，结果找到一个但没有文档。我知道没有_source我不能get 或 search，但如何检索我的文档？

Answer 1

来自 Elasticsearch 的网站:

The _source field contains the original JSON document body that was passed at index time. The _source field itself is not indexed (and thus is not searchable), but it is stored so that it can be returned when executing fetch requests, like get or search

禁用源将阻止 Elasticsearch 在结果集中显示它。但过滤、查询和聚合不会受到影响。

因此这两个查询不会生成任何实际结果:

获取 mq-body-local/body/_search

获取 mq-body-local/body/1

但是，您可以运行此聚合，其中将包含一些源，例如:

POST mq-body-local/body/_search

{
  "aggs": {
    "test": {
      "terms": {
        "field": "body"
      }
    }
  }
}

将产生这个结果集(我已经创建了一些测试记录):

"aggregations": {
    "test": {
      "doc_count_error_upper_bound": 0,
      "sum_other_doc_count": 0,
      "buckets": [
        {
          "key": "my body",
          "doc_count": 1
        },
        {
          "key": "my body2",
          "doc_count": 1
        }
      ]
    }
  }