Source

The _source field contains the original JSON document body that was indexed. While this field is not searchable, it is stored so that the full document can be returned when executing fetch requests, such as get and search.

Disabling the field

You can disable the _source field by setting the enabled parameter to false, as shown in the following example request:

PUT sample-index1
{
  "mappings": {
    "_source": {
      "enabled": false
    }
  }
}

Disabling the _source field can impact the availability of certain features, such as the update, update_by_query, and reindex APIs, as well as the ability to debug queries or aggregations using the original indexed document.

Including or excluding fields

You can selectively control the contents of the _source field by using the includes and excludes parameters. This allows you to prune the stored _source field after it is indexed but before it is saved, as shown in the following example request:

PUT logs
{
  "mappings": {
    "_source": {
      "includes": [
        "*.count",
        "meta.*"
      ],
      "excludes": [
        "meta.description",
        "meta.other.*"
      ]
    }
  }
}

These fields are not stored in the _source, but you can still search them because the data remains indexed.