What is _source in Elasticsearch: Explanation and Usage

_source in Elasticsearch is the original JSON document you indexed, stored as-is. It allows you to retrieve the full content of a document when you search or get it by ID.

How It Works

Imagine you have a filing cabinet where you keep copies of all your important papers. In Elasticsearch, _source is like that original copy of your document stored safely. When you add a document to Elasticsearch, it saves the entire JSON you sent in the _source field.

Later, when you search or ask for a document by its ID, Elasticsearch uses _source to show you exactly what you stored. This means you get the full original data back without needing to reconstruct it from parts.

You can also choose to exclude or include certain fields from _source when retrieving documents, which helps if you only want some parts of the data.

Example

This example shows how to index a document and then retrieve it with the _source field.

json

PUT /my_index/_doc/1
{
  "name": "Alice",
  "age": 30,
  "city": "New York"
}

GET /my_index/_doc/1

GET /my_index/_search
{
  "query": {
    "match": { "name": "Alice" }
  },
  "_source": ["name", "city"]
}

Output

{
  "_index": "my_index",
  "_id": "1",
  "_source": {
    "name": "Alice",
    "age": 30,
    "city": "New York"
  }
}

{
  "hits": {
    "hits": [
      {
        "_source": {
          "name": "Alice",
          "city": "New York"
        }
      }
    ]
  }
}

When to Use

Use _source whenever you want to get back the full original document you stored in Elasticsearch. This is helpful for displaying search results exactly as they were saved.

It is also useful when you want to selectively retrieve parts of the document to reduce data transfer, by specifying which fields to include or exclude from _source.

For example, an e-commerce site can store product details in _source and retrieve only the product name and price when showing search results, improving speed and efficiency.

Key Points

• _source stores the original JSON document in Elasticsearch.
• It is returned by default when you get or search documents.
• You can include or exclude fields from _source to control what data is returned.
• Disabling _source is possible but not recommended because it prevents retrieving the original document.

Key Takeaways

_source holds the original document JSON stored in Elasticsearch.

It allows retrieving the full or partial document when searching or getting by ID.

You can customize which fields from _source to return for efficiency.

Disabling _source stops Elasticsearch from returning the original document.

Use _source to display or process the exact data you indexed.