Source filtering in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is source filtering in Elasticsearch?

Source filtering lets you choose which parts of the document you want to get back in the search results. It helps reduce the amount of data sent over the network.

beginner

How do you exclude fields using source filtering?

You use the _source field with an excludes list to tell Elasticsearch which fields to leave out from the results.

beginner

Show an example of including only specific fields with source filtering.

Use _source with an includes list. For example:

{"_source": {"includes": ["title", "author"]}}

This returns only the title and author fields.

beginner

Why use source filtering in Elasticsearch?

It makes your search faster and lighter by sending only the data you need. This saves bandwidth and improves performance.

intermediate

Can source filtering be used with nested fields?

Yes, you can include or exclude nested fields by specifying their full path in the includes or excludes lists.

What does source filtering control in Elasticsearch?

A Which fields are returned in the search results

B Which documents are indexed

C How documents are scored

D The order of search results

Source filtering controls which fields are included or excluded in the search results.

How do you exclude the field 'password' from search results using source filtering?

A {"fields": ["password"]}

B {"_source": {"includes": ["password"]}}

C {"_source": {"excludes": ["password"]}}

D {"filter": {"password": false}}

Using excludes with the field name removes it from the returned source.

If you want only 'title' and 'date' fields in the results, which source filtering option is correct?

A {"_source": {"includes": ["title", "date"]}}

B {"_source": {"excludes": ["title", "date"]}}

C {"fields": ["title", "date"]}

D {"filter": {"title": true, "date": true}}

The includes list specifies which fields to return.

What happens if you do not use source filtering in a query?

A No fields are returned

B All fields of the document are returned

C Only the document ID is returned

D The query will fail

By default, Elasticsearch returns the entire source document.

Can source filtering improve network performance?

A Yes, but only for aggregations

B No, it only affects indexing

C No, it slows down queries

D Yes, by reducing data sent over the network

Source filtering reduces the size of the response, improving network performance.

Explain what source filtering is and why it is useful in Elasticsearch.

Think about how you can get only the parts of a document you need.

Describe how to include and exclude fields using source filtering with examples.

Remember the JSON keys 'includes' and 'excludes' inside '_source'.

Practice

1. What is the main purpose of _source filtering in Elasticsearch?

easy

A. To control which parts of the document are returned in search results

B. To filter documents before indexing

C. To change the document content during indexing

D. To sort search results by field values

Solution

1. Step 1: Understand _source filtering role

   _source filtering controls which fields of a document are included in the search response.

2. Step 2: Differentiate from other features

   It does not affect indexing or sorting, only what data is returned after a search.

3. Final Answer:

   To control which parts of the document are returned in search results -> Option A

4. Quick Check:

   Source filtering = control returned fields [OK]

Hint: Remember: source filtering limits returned fields only [OK]

Common Mistakes:

• Confusing source filtering with indexing filters
• Thinking it changes document content
• Assuming it sorts results

2. Which of the following is the correct syntax to exclude the field password from the search results using source filtering?

easy

A. "_source": { "filter": ["password"] }

B. "_source": { "include": ["password"] }

C. "_source": { "excludes": ["password"] }

D. "_source": { "remove": ["password"] }

Solution

1. Step 1: Recall source filtering syntax

   To exclude fields, use "excludes" inside _source with a list of field names.

2. Step 2: Match correct syntax

   "_source": { "excludes": ["password"] } uses "excludes": ["password"], which is the correct way to exclude the password field.

3. Final Answer:

   "_source": { "excludes": ["password"] } -> Option C

4. Quick Check:

   Exclude fields = use "excludes" key [OK]

Hint: Use "excludes" key to remove fields from results [OK]

Common Mistakes:

• Using "include" to exclude fields
• Using non-existent keys like "filter" or "remove"
• Wrong JSON structure

3. Given this Elasticsearch query snippet, what fields will be returned in the search results?

{
  "_source": { "includes": ["title", "author"] },
  "query": { "match_all": {} }
}

medium

A. All fields will be returned

B. All fields except title and author will be returned

C. No fields will be returned

D. Only the fields title and author will be returned

Solution

1. Step 1: Understand includes in _source

   The includes key specifies which fields to return from the document.

2. Step 2: Apply to given query

   Since only title and author are included, only these fields will appear in the results.

3. Final Answer:

   Only the fields title and author will be returned -> Option D

4. Quick Check:

   includes fields = return only those fields [OK]

Hint: includes means return only listed fields [OK]

Common Mistakes:

• Thinking includes excludes fields
• Assuming all fields return by default
• Confusing includes with excludes

4. Identify the error in this source filtering snippet:

{
  "_source": {
    "includes": "title,author"
  },
  "query": { "match_all": {} }
}

medium

A. The _source key is misspelled

B. The includes field should be a list, not a comma-separated string

C. The query is missing a filter clause

D. The match_all query is invalid

Solution

1. Step 1: Check includes value type

   The includes field expects an array of strings, not a single comma-separated string.

2. Step 2: Identify correct format

   It should be ["title", "author"] instead of "title,author".

3. Final Answer:

   The includes field should be a list, not a comma-separated string -> Option B

4. Quick Check:

   includes must be an array, not a string [OK]

Hint: Use arrays for includes/excludes fields, not strings [OK]

Common Mistakes:

• Using comma-separated strings instead of arrays
• Misspelling _source key
• Confusing query errors with source filtering

5. You want to return all fields except password and ssn from documents, but also include only the name and email fields explicitly. Which source filtering configuration achieves this correctly?

hard

A. "_source": { "includes": ["name", "email"], "excludes": ["password", "ssn"] }

B. "_source": { "include": ["name", "email", "password", "ssn"] }

C. "_source": { "exclude": ["password", "ssn"] }

D. "_source": { "include": ["name", "email"] }

Solution

1. Step 1: Understand combined includes and excludes

   Using both includes and excludes lets you specify fields to return and fields to omit.

2. Step 2: Analyze options

   "_source": { "includes": ["name", "email"], "excludes": ["password", "ssn"] } includes name and email but excludes password and ssn, matching the requirement.

3. Final Answer:

   "_source": { "includes": ["name", "email"], "excludes": ["password", "ssn"] } -> Option A

4. Quick Check:

   includes + excludes together filters fields precisely [OK]

Hint: Combine includes and excludes to fine-tune returned fields [OK]

Common Mistakes:

• Using only includes or excludes, missing fields
• Including fields meant to be excluded
• Misunderstanding combined filtering behavior