Source filtering in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this source filtering query?

Given the following Elasticsearch query that uses source filtering, what fields will be included in the response's _source?

Elasticsearch

{
  "_source": ["user", "post_date"],
  "query": {
    "match": {"message": "search"}
  }
}

A All fields will be included because <code>_source</code> is ignored in this query.

B Only the fields <code>user</code> and <code>post_date</code> will be included in <code>_source</code>.

C Only the <code>message</code> field will be included in <code>_source</code>.

D No fields will be included in <code>_source</code> because the query filters them out.

💡 Hint

Think about what the _source array specifies in the query.

The _source field in the query specifies which fields to include in the response. Here, only user and post_date are included.

❓ Predict Output

intermediate

What fields are excluded by this source filtering?

Consider this Elasticsearch query snippet:

{
  "_source": { "excludes": ["comments", "metadata"] },
  "query": { "match_all": {} }
}

Which fields will not appear in the _source of the response?

A The fields <code>comments</code> and <code>metadata</code> will be excluded from the response <code>_source</code>.

B All fields will be included because excludes is ignored.

C Only the fields <code>comments</code> and <code>metadata</code> will be included.

D No fields will be excluded; the query will return an empty <code>_source</code>.

💡 Hint

Look at what the excludes array does in _source.

The excludes array tells Elasticsearch to omit those fields from the _source in the response.

🔧 Debug

advanced

Why does this source filtering query cause an error?

Examine this Elasticsearch query:

{
  "_source": ["user", {"post_date"}],
  "query": { "match": {"message": "error"} }
}

What is the cause of the error?

A The query is missing the <code>size</code> parameter.

B The <code>match</code> query is missing a closing brace.

C The <code>_source</code> field must be a string, not an array.

D The <code>_source</code> array contains an invalid object instead of a string for field names.

💡 Hint

Check the format of the _source array elements.

The _source array must contain only strings representing field names. Here, {"post_date"} is an invalid object, causing a syntax error.

🧠 Conceptual

advanced

What is the effect of using _source: false in a query?

In Elasticsearch, what happens if you set "_source": false in your search query?

A The query will return all fields in <code>_source</code> as usual.

B The query will fail with a syntax error because <code>_source</code> cannot be false.

C The response will not include the <code>_source</code> field at all, returning only metadata like <code>_id</code> and <code>_score</code>.

D The query will include only the <code>_source</code> fields that are indexed.

💡 Hint

Think about what disabling _source means for the response.

Setting "_source": false tells Elasticsearch not to include the document source in the response, only metadata like _id and _score are returned.

❓ Predict Output

expert

How many fields are returned with this nested source filtering?

Given this Elasticsearch query:

{
  "_source": {
    "includes": ["user", "comments.text"],
    "excludes": ["user.email"]
  },
  "query": { "match_all": {} }
}

Assuming documents have fields user.name, user.email, comments.text, and comments.date, how many fields will appear in the _source of each hit?

A 2 fields: <code>user.name</code> and <code>comments.text</code> (excluding <code>user.email</code>).

B 3 fields: <code>user.name</code>, <code>user.email</code>, and <code>comments.text</code>.

C Only 1 field: <code>comments.text</code> because <code>user.email</code> is excluded and <code>user</code> is partially included.

D All fields are returned because excludes are ignored when includes are used.

💡 Hint

Remember that excludes remove fields even if includes select their parent.

The includes select user and comments.text. The excludes remove user.email. So user.name and comments.text remain.