Question

I have a document with a number of fields that I never query on so I would like to turn indexing on those fields off to save resources. I believe I need to disable the _all field, but how do I specify which fields are indexed then?

Answer 1

By default all the fields are indexed within the _all special field as well, which provides the so called catchall feature out of the box. However, you can specify for each field in your mapping whether you want to add it to the _all field or not, through the include_in_all option:

"person" : {
    "properties" : {
        "name" : {
            "type" : "string", "store" : "yes", "include_in_all" : false
        }
    }
}

The above example disables the default behaviour for the name field, which won’t be part of the _all field.

Otherwise, if you don’t need the _all field at all for a specific type you can disable it like this, again in your mapping:

"person" : {
    "_all" : {"enabled" : false},
    "properties" : {
        "name" : {
            "type" : "string", "store" : "yes"
        }
    }
}

When you disable it your fields will still be indexed separately, but you won’t have the catchall feature that _all provides. You will need then to query your specific fields instead of relying on the _all special field, that’s it. In fact, when you query and don’t specify a field, elasticsearch queries the _all field under the hood, unless you override the default field to query.