2

I'm struggling to find out the best way to filter out the response JSON from Elastic Search search query, I know two of them, they are as follows:

I can't decide which one to use, what effect they'll be having on the query, performance, and other aspects.

kzrfaisal
  • 1,355
  • 5
  • 15
  • 26

1 Answers1

0

filter_path is somewhat of a superset of _source. It enables you to get rid of the response metadata while _source is limited to the docs' actual source.

Exempli gratia: ?filter_path=hits.hits._source.id is similar to ?_source=id but the former will result in

{
  "hits" : {
    "hits" : [
      {
        "_source" : {
          "id" : "O1819976"
        }
      },
      ...

while the latter contains all the common details:

{
  "took" : 39,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : 11,
    "max_score" : null,
    "hits" : [
      {
        "_index" : "...",
        "_type" : "...",
        "_id" : "O1819976",
        "_score" : null,
        "_ignored" : [
          ...
        ],
        "_source" : {
          "id" : "O1819976"       <----
        }
      },

Neither of them affects the query performance since they're applied after the search phase.

I suppose filter_path could be slightly faster at the end b/c there are fewer JSON bytes to transfer over the network.

Joe - GMapsBook.com
  • 15,787
  • 4
  • 23
  • 68
  • 1
    In order to add to @joe's answer, there's a third possibility using [`docvalue_fields`](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-request-body.html#request-body-search-docvalue-fields) instead of source filtering (for any field types except `text`). Field data is retrieved from doc values per field instead of loading the whole `_source` document and filtering it. That's what Kibana does! – Val Jul 04 '20 at 04:39
  • And a fourth way is by using [stored fields](https://www.elastic.co/guide/en/elasticsearch/reference/current/run-a-search.html#stored-fields) – Val Jul 04 '20 at 04:41