A simple understanding of Elasticsearch 5.0 _all field

The purpose of this paper is to pave the future of disk space Utilization optimization, and the main knowledge points are from the official website first, what is _all?

In Elasticsearch, _all Field maintains this very large array of strings (text type). This string is the other fields that are preceded by participle, and then grouped together to form. combination: The space is delimited, unordered.

The official website has an example

PUT my_index/user/1 
{
  "first_name":    "John",
  "last_name":     "Smith",
  "Date_of_birth": " 1970-10-24 "
}

GET my_index/_search
{"
  query": {"
    match": {
      "_all": "John Smith New York
    }}
}"

Put in three field data, at this time _all maintained string array is as follows: ["John", "Smith", "1970", "Ten", "[]"] Second, what is the role of _all

Allows you to search without knowing the field

In some cases you have no idea which field the value you are searching for belongs to. The script above directly replaces the _all with the

You can disable off _all field by following the command below.

PUT my_index
{
  "mappings": {"
    type_1": { 
      "Properties": {...}
    },
    "type_2": { 
      "_all"
        : { "Enabled": false
      },
      "Properties": {...}}
  }

_all field is a text type and can be decorated with the following parameters as other normal string field:Analyzer,term_vectors,index_options ,store Three, disable off _all will be how negative impact: Can not know field in the case of some value search and other operations Active impact: Reduce CPU burden, reduce disk consumption