Source filtering in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this source filtering query?

Given the following Elasticsearch query that uses source filtering, what fields will be included in the response's _source?

Elasticsearch

{
  "_source": ["user", "post_date"],
  "query": {
    "match": {"message": "search"}
  }
}

A All fields will be included because <code>_source</code> is ignored in this query.

B Only the fields <code>user</code> and <code>post_date</code> will be included in <code>_source</code>.

C Only the <code>message</code> field will be included in <code>_source</code>.

D No fields will be included in <code>_source</code> because the query filters them out.

💡 Hint

Think about what the _source array specifies in the query.

The _source field in the query specifies which fields to include in the response. Here, only user and post_date are included.

❓ Predict Output

intermediate

What fields are excluded by this source filtering?

Consider this Elasticsearch query snippet:

{
  "_source": { "excludes": ["comments", "metadata"] },
  "query": { "match_all": {} }
}

Which fields will not appear in the _source of the response?

A The fields <code>comments</code> and <code>metadata</code> will be excluded from the response <code>_source</code>.

B All fields will be included because excludes is ignored.

C Only the fields <code>comments</code> and <code>metadata</code> will be included.

D No fields will be excluded; the query will return an empty <code>_source</code>.

💡 Hint

Look at what the excludes array does in _source.

The excludes array tells Elasticsearch to omit those fields from the _source in the response.

🔧 Debug

advanced

Why does this source filtering query cause an error?

Examine this Elasticsearch query:

{
  "_source": ["user", {"post_date"}],
  "query": { "match": {"message": "error"} }
}

What is the cause of the error?

A The query is missing the <code>size</code> parameter.

B The <code>match</code> query is missing a closing brace.

C The <code>_source</code> field must be a string, not an array.

D The <code>_source</code> array contains an invalid object instead of a string for field names.

💡 Hint

Check the format of the _source array elements.

The _source array must contain only strings representing field names. Here, {"post_date"} is an invalid object, causing a syntax error.

🧠 Conceptual

advanced

What is the effect of using _source: false in a query?

In Elasticsearch, what happens if you set "_source": false in your search query?

A The query will return all fields in <code>_source</code> as usual.

B The query will fail with a syntax error because <code>_source</code> cannot be false.

C The response will not include the <code>_source</code> field at all, returning only metadata like <code>_id</code> and <code>_score</code>.

D The query will include only the <code>_source</code> fields that are indexed.

💡 Hint

Think about what disabling _source means for the response.

Setting "_source": false tells Elasticsearch not to include the document source in the response, only metadata like _id and _score are returned.

❓ Predict Output

expert

How many fields are returned with this nested source filtering?

Given this Elasticsearch query:

{
  "_source": {
    "includes": ["user", "comments.text"],
    "excludes": ["user.email"]
  },
  "query": { "match_all": {} }
}

Assuming documents have fields user.name, user.email, comments.text, and comments.date, how many fields will appear in the _source of each hit?

A 2 fields: <code>user.name</code> and <code>comments.text</code> (excluding <code>user.email</code>).

B 3 fields: <code>user.name</code>, <code>user.email</code>, and <code>comments.text</code>.

C Only 1 field: <code>comments.text</code> because <code>user.email</code> is excluded and <code>user</code> is partially included.

D All fields are returned because excludes are ignored when includes are used.

💡 Hint

Remember that excludes remove fields even if includes select their parent.

The includes select user and comments.text. The excludes remove user.email. So user.name and comments.text remain.

Practice

1. What is the main purpose of _source filtering in Elasticsearch?

easy

A. To control which parts of the document are returned in search results

B. To filter documents before indexing

C. To change the document content during indexing

D. To sort search results by field values

Solution

1. Step 1: Understand _source filtering role

   _source filtering controls which fields of a document are included in the search response.

2. Step 2: Differentiate from other features

   It does not affect indexing or sorting, only what data is returned after a search.

3. Final Answer:

   To control which parts of the document are returned in search results -> Option A

4. Quick Check:

   Source filtering = control returned fields [OK]

Hint: Remember: source filtering limits returned fields only [OK]

Common Mistakes:

• Confusing source filtering with indexing filters
• Thinking it changes document content
• Assuming it sorts results

2. Which of the following is the correct syntax to exclude the field password from the search results using source filtering?

easy

A. "_source": { "filter": ["password"] }

B. "_source": { "include": ["password"] }

C. "_source": { "excludes": ["password"] }

D. "_source": { "remove": ["password"] }

Solution

1. Step 1: Recall source filtering syntax

   To exclude fields, use "excludes" inside _source with a list of field names.

2. Step 2: Match correct syntax

   "_source": { "excludes": ["password"] } uses "excludes": ["password"], which is the correct way to exclude the password field.

3. Final Answer:

   "_source": { "excludes": ["password"] } -> Option C

4. Quick Check:

   Exclude fields = use "excludes" key [OK]

Hint: Use "excludes" key to remove fields from results [OK]

Common Mistakes:

• Using "include" to exclude fields
• Using non-existent keys like "filter" or "remove"
• Wrong JSON structure

3. Given this Elasticsearch query snippet, what fields will be returned in the search results?

{
  "_source": { "includes": ["title", "author"] },
  "query": { "match_all": {} }
}

medium

A. All fields will be returned

B. All fields except title and author will be returned

C. No fields will be returned

D. Only the fields title and author will be returned

Solution

1. Step 1: Understand includes in _source

   The includes key specifies which fields to return from the document.

2. Step 2: Apply to given query

   Since only title and author are included, only these fields will appear in the results.

3. Final Answer:

   Only the fields title and author will be returned -> Option D

4. Quick Check:

   includes fields = return only those fields [OK]

Hint: includes means return only listed fields [OK]

Common Mistakes:

• Thinking includes excludes fields
• Assuming all fields return by default
• Confusing includes with excludes

4. Identify the error in this source filtering snippet:

{
  "_source": {
    "includes": "title,author"
  },
  "query": { "match_all": {} }
}

medium

A. The _source key is misspelled

B. The includes field should be a list, not a comma-separated string

C. The query is missing a filter clause

D. The match_all query is invalid

Solution

1. Step 1: Check includes value type

   The includes field expects an array of strings, not a single comma-separated string.

2. Step 2: Identify correct format

   It should be ["title", "author"] instead of "title,author".

3. Final Answer:

   The includes field should be a list, not a comma-separated string -> Option B

4. Quick Check:

   includes must be an array, not a string [OK]

Hint: Use arrays for includes/excludes fields, not strings [OK]

Common Mistakes:

• Using comma-separated strings instead of arrays
• Misspelling _source key
• Confusing query errors with source filtering

5. You want to return all fields except password and ssn from documents, but also include only the name and email fields explicitly. Which source filtering configuration achieves this correctly?

hard

A. "_source": { "includes": ["name", "email"], "excludes": ["password", "ssn"] }

B. "_source": { "include": ["name", "email", "password", "ssn"] }

C. "_source": { "exclude": ["password", "ssn"] }

D. "_source": { "include": ["name", "email"] }

Solution

1. Step 1: Understand combined includes and excludes

   Using both includes and excludes lets you specify fields to return and fields to omit.

2. Step 2: Analyze options

   "_source": { "includes": ["name", "email"], "excludes": ["password", "ssn"] } includes name and email but excludes password and ssn, matching the requirement.

3. Final Answer:

   "_source": { "includes": ["name", "email"], "excludes": ["password", "ssn"] } -> Option A

4. Quick Check:

   includes + excludes together filters fields precisely [OK]

Hint: Combine includes and excludes to fine-tune returned fields [OK]

Common Mistakes:

• Using only includes or excludes, missing fields
• Including fields meant to be excluded
• Misunderstanding combined filtering behavior